Agentforce Is On in Your Org: What to Inventory Before the Setup Toggle Goes Away
The Agentforce platform is now on by default for eligible orgs, and Salesforce plans to remove the Setup toggle later in Winter '27. Use the quiet period to inventory who can build agents, which agents exist, what they run as, and what they can reach.
Short answer: The Salesforce Developers blog says "the Agentforce platform is now turned on by default." That applies to eligible orgs with Agentforce access, such as Lightning Experience orgs with Salesforce Foundations on Enterprise, Performance, Unlimited or Developer Edition, plus Agentforce 1 Edition. New orgs get it at creation. Existing orgs have been enabled on a rolling basis since early September 2026, and Salesforce plans to remove the Setup toggle later in Winter '27. Default-on doesn't mean an agent is running: agents still have to be built, given access and activated. Use the quiet period to record who can build agents, which agents exist, what they run as, and what they can reach.
What "on by default" changes
The platform features are switched on, so admins get Agentforce Builder and related tools. No agent acts until someone creates and activates it. Salesforce says enablement itself adds no cost. Check your order form for usage terms.
Can I turn it off?
After the toggle is removed, the broad off switch is turning off Einstein generative AI on the Einstein Setup page. That also turns off other generative AI features. You can deactivate individual agents in Agentforce Builder.
The inventory: do it while the org is still quiet
| # | Record | Why it matters | |---|---|---| | 1 | Every org (production, sandbox, dev) with Agentforce access | Enablement is rolling, so don't infer it from the date | | 2 | Who can build or administer agents: admins and holders of Manage AI Agents | Manage AI Agents is org-wide authority | | 3 | Every agent and its state (draft, testing, active) | You can't secure what you haven't listed | | 4 | Each active agent's channel and who it runs as (the logged-in user or a dedicated Agent User) | That identity determines what the agent can see | | 5 | What that identity can reach: objects, field-level security, sharing, flows (check run context), Apex, prompt templates | Page layout isn't a security boundary | | 6 | Connections it can call: named credentials, MCP server tools added in Builder, APIs in API Catalog, connected apps / External Client Apps | Every connection is a path out of the org | | 7 | Where untrusted data enters: Web-to-Lead, Web-to-Case, email-to-case, guest/community inputs | A prompt can be planted in that data | | 8 | Guest data exposure (Guest User Sharing Rule Access Report) | Public inputs and public reads. See our [Experience Cloud guest access audit](/insights/experience-cloud-guest-access-audit-before-spring-27). | | 9 | Audit evidence: who created and activated each agent; Setup Audit Trail access (the new permission is enforced in Spring '27) | Reviewers need it |
Why #7 matters: Zenity Labs published "SalesBleed" (Sep 24, 2026), now fixed. In it, an instruction hidden in a public form submission was later read by an agent that could also read Accounts. The lesson is the pattern: untrusted input, plus broad read access, plus a way out. It doesn't show that Agentforce is unsafe.
Inventory template
| Org | Agentforce access? | Einstein gen AI on? | Admins + Manage AI Agents holders | Agent | Status | Channel | Runs as | Permission sets | Flows/Apex/actions | External/MCP connections | Untrusted inputs read | Owner | Next review | |---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Red flags to fix first
- Manage AI Agents granted to people who don't build agents
- An Agent User with broad permission sets or View All / Modify All
- Agents that read public-form objects *and* hold read access on sensitive objects
- Flows called by agent actions that run in system context (Winter '27 adds "User Context—Enforces User Permissions")
- MCP or API Catalog entries that nobody owns
Next step
Next, do a least-privilege audit of each agent's user, then repeat the inventory after every release. For the field-level piece, see our [field-level security fix](https://www.wrenk.ai/fix/field-level-security).
FAQ
Is Salesforce turning on Agentforce automatically?
Yes, for eligible orgs, on a rolling basis since early September 2026.
Does that mean an agent is running?
No. Agents must be built and activated.
How do I turn it off after the toggle is gone?
Turn off Einstein generative AI. That's broader than Agentforce alone.
Does it cost extra?
Salesforce says enablement doesn't. Check your contract for usage terms.
Want a quick read on your org's health first? Answer three questions in the free health check. It needs no account and no sales call: [Start the free health check →](https://wrenk.ai/free-health-check?utm_source=wrenk_insights&utm_medium=blog&utm_campaign=wrenk-11-agentforce)