Salesforce Decode
Salesforcedecode
Back to questions
AgentforceArchitect (Hardest)securityprompt-injectionagent-actionszero-trust

Secure Agentforce actions against prompt injection and over-permissioned tools

Real World Scenario

Security review flagged that your service agent can update cases, issue refunds, and read contact PII. Pen testers demonstrated indirect prompt injection via a malicious knowledge article title.

Expected Answer

• Apply least-privilege action sets per agent persona—separate read-only informational agents from transactional ones • Validate and sanitize all retrieved content before inclusion in LLM context; strip HTML/scripts from knowledge chunks • Use server-side authorization on every action execution—never trust the LLM for access control decisions • Implement confirmation flows for high-impact writes (refunds, account changes) with step-up verification • Monitor anomalous action patterns: velocity limits, unusual refund amounts, cross-account access attempts • Separate untrusted user input from system instructions using structured prompt templates • Conduct regular purple-team exercises with injection scenarios in knowledge, cases, and chat history

Follow-Up Questions & Answers

Click to expand — each follow-up includes a direct, interview-ready answer

Security first: Apply least-privilege action sets per agent persona—separate read-only informational agents from transactional ones. Enforce CRUD/FLS explicitly — `with sharing` alone is not enough. Validate and sanitize all retrieved content before inclusion in LLM context; strip HTML/scripts from knowledge chunks. Agent security is OWASP for LLMs plus Salesforce CRUD/FLS. Document the decision in an ADR and align with enterprise standards.

Architect Perspective

Agent security is OWASP for LLMs plus Salesforce CRUD/FLS. The LLM is part of your attack surface—assume retrieved content is hostile. Authorization must happen at action execution time in Apex/Flow, not in natural language instructions.