Is your Salesforce org safe for Agentforce and MeshMesh?

Why now

• Salesforce is auto-enabling Agentforce in Winter '27 for orgs with Agentforce access, which Salesforce Ben lists as Foundations on Enterprise, Performance, Unlimited and Developer Edition, plus Agentforce 1 Edition. Its article is dated 2026-08-31 and says the change was in preview, with no additional cost stated by Salesforce. Salesforce Ben
• The MeshMesh beta opened on 2026-11-05, and on 2026-11-09 its docs added an "Audit Snapshot of Org Health" recipe, described as a read-only health check. It is a beta, not generally available. docs.meshmesh.io
• SaaStr wrote that a well-regarded agent from a vendor it chose not to name deleted nearly all of its Salesforce opportunities shortly after being connected, and that the vendor's agent had no rollback. It restored from a snapshot it had never planned as a backup. Its new rule: "A new vendor's agent starts read-only on our systems." SaaStr

What to check before an agent gets write access

Six checks an admin can run in Setup with no outside help. They apply to any agent, from any vendor.

1. Who holds Manage AI Agents. Salesforce Ben notes that non-admin users need the Manage AI Agents permission to build agents. List every user and permission set that has it, and remove it from anyone who does not need it.
2. Org-wide defaults and over-broad sharing. Review org-wide defaults on the objects an agent will touch, and any sharing rules, profiles or permission sets that grant View All, Modify All or broad delete. An agent can reach whatever its user can reach.
3. Which user the agent runs as, and what that user can modify or delete. Find the user or integration identity the agent acts as. Open its effective permissions on each object and field. If that user can delete opportunities, so can the agent. Prefer a dedicated user with the narrowest access that works.
4. Automations that fire on the objects the agent will touch. List the flows, Apex triggers, validation rules and process automation on those objects. An agent's single write can start a chain of other writes, emails or callouts. Know the chain before the agent starts it.
5. Integration users and what writes overnight. Inventory integration users, connected apps and scheduled jobs that write to the same objects. Overlapping writers are how an agent's change gets overwritten, or how it overwrites someone else's.
6. What you would roll back, and from which copy. For each object an agent can write, name the independent copy you would restore from and when it was last taken. Check that the agent cannot write to that copy. If you cannot name it, the agent should start read-only.

Two agent systems in one org

When MeshMesh, Agentforce or Wrenk can all change the org, four questions need one named answer each:

• Who may write? Name each agent system and the user it runs as, and what each may create, change or delete.
• Which sandbox? Decide where each agent's changes are tested first, and whether two systems can touch the same sandbox.
• Who approves production? One named person or group signs off on production changes, whichever system proposed them.
• Who owns rollback? One owner, with the copy to restore from, for changes made by any of the systems.

See also Salesforce MeshMesh, explained and Claudeforce readiness.

Where Wrenk fits

The audit is now a commodity. MeshMesh and several other tools will run one, and you can run the checklist above yourself. Wrenk is the independent team that does the cleanup and stays on. It is an AI admin team and platform: agents plan and make the fixes with your approval, and people stand behind them. It works across Salesforce and HubSpot, is built to support ServiceNow, and works inside Claude, ChatGPT, Gemini and Copilot.

Prices read from wrenk.ai/pricing on Nov 11, 2026.

1. Free health check: free, three questions, no account, nothing connected.
2. Org Repair: $1,500 one-time. A Wrenk admin works through your findings.
3. Monitoring Membership: $300 per month. Scheduled checks, with a Wrenk admin handling what comes up.
4. Managed Operations: from $3,000 per month. Wrenk works your backlog for you.