Data Divers Dialogs · Analysis · By Christian Schappeit · September 2026 · approx. 7 min read
Salesforce and Anthropic have connected a frontier model to live pipeline data, and they have done it carefully. The permission model is correct. The documentation is honest. Neither of them answers the question a validated system actually asks.
An administrator clicks once. That is the entire setup.
From that moment every seller in the org can ask Claude to prepare a meeting, review the health of a deal, or walk a pipeline. No per-user configuration. No re-auditing account by account. Salesforce is pleased about this and says so, and it is right to be — this is good engineering, and it retires a genuinely tedious problem.
Then, several layers down, in the developer documentation for the server underneath it all, there is a sentence of admirable honesty.
The audit trail attributes every action to you.
That is the correct answer to the security question. It is also the sentence a validation team will read four times.
Claudeforce was announced on the afternoon Salesforce reported its second quarter: revenue of $11.345bn, up 11%; Agentforce ARR past $1.5bn, up more than 240%; cRPO of $33.5bn. The stock went up. Marc Benioff told the call that "this nonsense of the SaaSpocalypse" should stop.
Salesforce in Claude puts the CRM inside the model. A plugin with 37 prebuilt sales skills — meeting prep, deal health, pipeline review — available to pilot customers now, open beta expected this month. Underneath it sits a hosted MCP server called Headless 360, in beta since July, offering four tools: discover an operation, describe it, dispatch it, or dispatch it read-only. Dispatch covers GET, POST, PUT, DELETE and PATCH.
It writes.
Claude in Salesforce points the other way: Claude as a reasoning model inside Agentforce, served through Amazon Bedrock, inside what Salesforce calls its Trust Boundary, offered explicitly to customers in regulated industries. And a third piece, quieter than either: Claude as the default model behind Slackbot.
You pay Salesforce for the API consumption and contract separately with Anthropic for the inference. One agent, two invoices, and — hold that thought — two rather different ideas about who is doing the work.
Patrick Stokes, who runs applications and marketing at Salesforce, described the security model in one sentence: "If you don't own that record, if you don't have permission to see that record, the MCP server doesn't either."
True, and correctly built. Requests run as the authenticated user, through an external client app scoped to the mcp_api permission. Object permissions hold. Field-level security holds. Sharing rules, profiles, permission sets — all of it survives the trip.
None of it is the question a regulated company has to answer.
Access control asks whether someone was allowed to. An audit trail in a validated system asks something else entirely: who did this, when, and on what basis — attributable to a person, because a person is the thing you can put a question to afterwards. For roughly two decades those looked like the same question, for the unglamorous reason that a human being clicked the button.
Now one question produces forty actions.
The trail is not wrong. Every entry in it is accurate. It is simply that you has quietly come to mean: a request you initiated, resolved by a model into operations you did not choose, against records you never opened, at a moment you were not necessarily present for.
Try explaining that distinction to an inspector who has spent fifteen years reading the same trail as evidence.
The audit trail is not lying. It has stopped describing what happened.
Then there is the Slack path, where the answer changes.
Anthropic's own documentation for connecting Salesforce to Claude Tag is refreshingly plain. You create a connected app using the OAuth JWT bearer flow, "with a dedicated integration user assigned to it". Read-only is the recommended starting point — a recommendation, note, not a default.
And then, to confirm it works:
Check the integration user's login history in Salesforce Setup to confirm the call landed under that user.
So. On one route, every action carries a named employee who did not perform it. On the other, no employee's name appears anywhere. Both were announced in the same press release, on the same day, as parts of the same product.
Neither is a mistake. Both are ordinary, defensible integration patterns, and that is rather the trouble. The industry solved machine identity years ago, and the answer it settled on quietly assumes the machine is not deciding anything.
The reassurance offered to regulated buyers is the Trust Boundary: Claude served through Bedrock inside Salesforce's own perimeter, rather than a round trip to somebody else's API. The inference happens where the data already lives.
This is worth something, and it is not nothing that Salesforce also holds a zero-retention policy with external model providers — data sent to the model is not kept, and is deleted once the response comes back. Both commitments are real. Neither is marketing.
But a boundary is a place. It tells you where the work happened. It does not tell you what the work was, whether the system did what it was specified to do, or who is answerable for the result. Even the warmest analysis of Claudeforce, written for financial services readers, concedes the point in passing: what the boundary answers is whether you can trust where this runs.
And on Salesforce's own training site, in the module explaining the Trust Layer, there is one more sentence worth taking to your next steering meeting.
Data masking for LLMs is disabled for agents.
Masking is the box everybody points at in the architecture diagram — the part that detects names and sensitive fields and strips them out before the prompt leaves the building. For embedded features such as service replies and work summaries, it is available. For agents it is off, for a reason that is obvious the moment you say it out loud: an agent that cannot see who the customer is cannot update the customer's record.
Nobody hid this. It sits in the training material in plain type. It is simply not in the announcement.
A week later, on 3 September, Salesforce collapsed its edition structure into three: Core at $195 per user per month, Advanced at $395, Max at $550. Each includes Agentforce, Slack, embedded agentic analytics and a pool of Flex Credits — 500,000, one million and 2.75 million respectively. Customers on the old Agentforce 1 Edition move to Max at no additional cost, which Salesforce describes as 60% more value.
For most buyers this is a better deal and a shorter price list.
In a validated environment it is a change.
Not a bad change. A change — the specific, documented, deeply boring kind that comes with an impact assessment, a risk-based decision about whether anything needs requalifying, and somebody's signature at the bottom of it. The trigger for all of that has always been that a person decided to do something.
Who requested this change?
Nobody did. It came with the edition. And the open beta lands in September, which is also when the Winter '27 platform release reaches production orgs — so the quarter a company spends regression-testing its CRM is the quarter a new kind of actor may turn up inside it.
In the projects I actually work on, this is the part that eats the year. Not whether the agent is capable. It is. Whether anyone can produce, on request, a document stating what it was permitted to do, what it did, and who agreed to that.
Two dates for the diary
September — Salesforce in Claude, open beta. The number to ask for is not a benchmark score. It is your own token consumption, measured on a pilot cohort, before anything is switched on across the org. Practitioners reading the MCP server documentation are already saying the same thing, and no credible figure has been published yet.
2 December 2027 — the postponed high-risk deadline. The Digital Omnibus moved the AI Act's stand-alone high-risk obligations from August 2026 to December 2027, and the ones for AI embedded in regulated products to August 2028. The relief is real and narrower than most people assume: the Article 50 transparency duties took effect on 2 August 2026 and were not postponed at all.
Benioff is probably right that the SaaSpocalypse was oversold, though not quite for the reason he gave. Enterprise software does not dissolve. It accumulates. The CRM stays, the permission sets stay, the change control process stays, and something new arrives that all three were designed before anyone imagined.
The interesting failure here is not a security failure. Both companies have been unusually careful, and both have documented the awkward parts in public where anybody can read them. The failure is definitional, and it happened years ago, in a schema.
Somewhere tonight an opportunity record will change at 03:14. In one org the trail will carry the name of a sales manager in Basel, who is asleep. In another it will carry a user called something like svc_claude_integration, who has never been asleep and has never been to Basel.
Both entries are accurate. Only one of them names somebody you can ask.
Claudeforce announced 26 August 2026. Salesforce in Claude: a plugin with 37 prebuilt sales skills, available to select pilot customers at announcement, open beta expected September 2026, further skills slated for late 2026. Claude in Salesforce: served via Amazon Bedrock within the Salesforce Trust Boundary. Salesforce Q2 FY27, reported 26 August 2026: revenue $11.345bn (+11% Y/Y), Agentforce ARR above $1.5bn (+240%+ Y/Y), cRPO $33.5bn (+14% in constant currency), total RPO $66.3bn, FY27 guidance raised to $46.1–46.4bn. Edition consolidation announced 3 September 2026: Core $195, Advanced $395, Max $550 per user per month, including 500,000 / 1,000,000 / 2,750,000 Flex Credits; Agentforce 1 Edition customers move to Max at no additional cost, described by Salesforce as 60% more value.
The quoted lines. "The audit trail attributes every action to you", the four Headless 360 tools and the mcp_api scope come from Salesforce's own developer documentation for the Hosted MCP Server, a Beta Service since July 2026. "Data masking for LLMs is disabled for agents" is from Salesforce's Trailhead module on LLM data masking in the Einstein Trust Layer and is repeated in Salesforce Help. The zero-retention policy with external model providers is Salesforce's own published commitment. The integration-user instruction, including "check the integration user's login history in Salesforce Setup to confirm the call landed under that user", is from Anthropic's Claude Tag documentation for connecting Salesforce. Patrick Stokes is quoted via VentureBeat; Benioff's "SaaSpocalypse" line was widely reported from the Q2 FY27 earnings call.
Confidence. Established: the products, dates, prices, figures and documentation quotes above. Emerging: the reading that per-user attribution and validation attribution have come apart in practice — the mechanism is documented, but no inspection finding, warning letter or regulatory guidance has yet tested it. Speculative: anything about how an inspector will actually treat an agent-generated audit trail. Neither company has published guidance on validating agent actions in a GxP context, and the Trust Boundary language should not be read as one.
Primary sources. Salesforce press release · Headless 360 MCP Server documentation · Anthropic, Connect Salesforce · Trailhead, LLM data masking · Einstein Trust Layer · Q2 FY27 results · Edition consolidation · VentureBeat · Apex Hours · Atrium · Gibson Dunn on the Digital Omnibus
Tags: Claudeforce · Agentforce · Audit Trail · GxP Validation · Annex 11 · Change Control · Procurement
German edition: Gearbeitet hat der Agent. Unterschrieben haben Sie.