AI agents are different from the software most businesses have dealt with before. Traditional software follows a script. An agent makes decisions, calls other systems, and can trigger further agents in a chain. A single customer service request can turn into a dozen downstream actions across your CRM, your ERP, your logistics platform, and a third-party AI model, all in seconds.
This creates a governance problem that most organisations have not solved yet. A recent survey of 445 IT and security professionals found that agents are already operating in core workflows and regularly exceeding their intended permissions. Gartner puts a number on the consequence: by 2027, 40% of companies will shut down agents they built because they failed to control the scope of access from the start.
The core failure is not technical. It is organisational. Most companies enforce identity controls in one place, data access rules in another, and API security in yet another. When an agent moves across all three in a single workflow, the gaps between those silos become the attack surface.
Salesforce's answer is to collapse those silos into one enforcement layer that sits between the agents and everything they can touch. When an agent acts on behalf of a user, that user's identity travels through every downstream system the agent calls. When an agent acts on its own, it carries its own identity instead. Either way, the same access rules apply, the same audit trail is generated, and any action that does not pass the policy check gets blocked.
The cost angle is underappreciated. When different teams across a business each connect directly to AI models from OpenAI, Anthropic, Google, or Amazon without any central oversight, token costs pile up with no visibility. MuleSoft's AI Gateway, now generally available, routes all those AI calls through a single point. It can automatically send simple tasks to cheaper models and reserve expensive models for complex work. One analyst summarised the risk of not doing this plainly: without central control, teams negotiate their own contracts, manage their own budgets locally, and the result is "sprawling costs, inconsistent security postures, and no enterprise-wide policy enforcement."
To complete this stack, Salesforce paid around $8 billion to acquire Informatica in November 2025. Informatica brings the ability to track data lineage across the whole enterprise, including systems outside Salesforce, and to automatically tag sensitive information the moment it enters the platform. When an agent retrieves data, those tags travel with it, so a piece of customer health data from an external ERP does not silently end up in an agent's response just because the agent had access to that system.
The honest version of this story is that Salesforce is also protecting its own commercial position. By making its governance layer the connective tissue between Agentforce, MuleSoft, Data 360, and Informatica, it makes it considerably harder for a business to pull one piece out and replace it with a competitor. Every tool you add from Salesforce deepens the dependency.
That does not make the underlying approach wrong. The problem it is solving is real. Gartner also found that applying a blanket governance policy to all agents equally leads to higher project failure rates. Simple read-only agents get over-controlled and slow everything down. Autonomous agents that can move money or update records get under-controlled and create real risk. The answer is proportional control, calibrated to what each agent can actually do.
For businesses not running Salesforce at all, the questions are the same regardless of vendor. Can you see, in one place, every action every agent took and why? Do you know which AI model handled which request, and what it cost? Does a piece of restricted data stay restricted even when an agent accesses it through an unusual route? If the answer to any of those is no, that is where the exposure is.