Salesforce Decode
Salesforcedecode
Back to questions
AgentforceArchitect (Hardest)custom-modelstrust-layerllm-routinggovernance

Route custom LLM models through Einstein Trust Layer policies

Real World Scenario

Enterprise architecture approved a fine-tuned domain model for product troubleshooting but security mandates all LLM traffic use Trust Layer masking and logging.

Expected Answer

• Evaluate whether custom model integrates via Einstein Trust Layer supported pathways vs prohibited direct callouts • If direct integration required, replicate masking and audit controls in middleware gateway • Define model routing rules by topic sensitivity—general FAQ vs regulated financial intents • Maintain model registry with owner, validation date, eval scores, and approved use cases • Implement fallback to Salesforce-managed models when custom endpoint unavailable • Compare output quality and cost across models with A/B telemetry—not anecdotal preference • Legal review of custom model training data provenance and output liability

Follow-Up Questions & Answers

Click to expand — each follow-up includes a direct, interview-ready answer

Security first: Evaluate whether custom model integrates via Einstein Trust Layer supported pathways vs prohibited direct callouts. Enforce CRUD/FLS explicitly — `with sharing` alone is not enough. If direct integration required, replicate masking and audit controls in middleware gateway. Custom models trade control for operational burden. Document the decision in an ADR and align with enterprise standards.

Architect Perspective

Custom models trade control for operational burden. Architects either stay on Trust Layer-native paths or accept building equivalent governance middleware themselves.