Before You Pilot Claudeforce

Claudeforce, announced by Salesforce and Anthropic on August 26, 2026, runs in two directions: Claude becomes a reasoning model inside Agentforce, and Salesforce becomes a plugin inside Claude with 37 sales skills that reason over live revenue context and take governed action. The word governed matters, and so does where the governing happens. As Apex Hours' technical breakdown of the launch shows, the permission check happens in your Salesforce org, not in Claude. That is good design, and it is also the reason the audit is on you. An over-provisioned profile that was harmless behind a slow, manual UI becomes genuinely risky behind an agent that can act across the whole revenue cycle at machine speed. Worse, the plugin's first run reads a seller's context across Salesforce, Slack, and every connected app to build a dashboard, so that first sweep touches everything the connection can reach. The time to know what that is, is before the pilot, not after.

There are two routes into Salesforce from Claude, and per Apex Hours they have genuinely different security postures that the marketing does not separate. The Salesforce in Claude plugin is built on Headless 360's Hosted MCP Server, which uses per-user OAuth: every call runs as the person making it, with their permissions. The Slack-based Claude Tag connection works differently, using an OAuth client-credentials flow with a dedicated integration user, so the credential belongs to the agent, not to any individual person, and every request in that bundle runs as that one user. That distinction decides who is accountable for a write and whose permissions bound it. Confirm which route your pilot uses before anything else, because the rest of the audit depends on it.

Salesforce's own announcement is explicit about setup: an admin connects Salesforce in Claude a single time, permissions are managed centrally, and every seller gets access from day one, with no per-user setup and no re-auditing account by account. That is a real onboarding win and the exact reason to audit first. On the per-user route, the agent inherits each seller's object and field permissions, sharing rules, and record access, and it will use all of them. Pull the profiles and permission sets in scope, list which objects and fields the connection can read and write, and find the standing over-provisioning that never mattered when a human had to click through screens to exploit it. Assume the agent will reach everything it is allowed to reach, because it will.

Under the plugin branding, Apex Hours notes the Headless 360 MCP server exposes a deliberately small surface of four tools: discover (semantic search across Salesforce operations), describe (the spec for an operation), dispatch (which performs GET, POST, PUT, DELETE, PATCH), and dispatch_readonly (GET only). That last tool exists so you can turn on analysis without turning on writes. Start there. Scope a Permission Set to the specific objects and fields the pilot needs, read-only to begin, and let the agent reason, summarize, and prep without changing a single record. Add write access one skill at a time, deliberately, only after you have watched what the agent actually does with read access. Autonomy over a given write type is something it earns after a clean track record, not a default you grant on day one.

This is the step teams skip because they file agent action under AI rather than under database write. A dispatch PATCH is a normal Salesforce write. Validation rules fire, Flows fire, Apex triggers fire, and your CPU-time governor limits apply exactly as they always have. An agent that bulk-updates 200 opportunities trips the same limits a Data Loader job would, as Apex Hours points out. Two implications for the pilot. First, load-test the skills that write, because a reasoning model can generate a burst of writes no human pace would. Second, turn on Salesforce duplicate management first: matching rules flag likely duplicates and duplicate rules either block the save or allow it with an alert, and an integration user writing at machine speed without them manufactures cleanup work at machine scale.

Claudeforce pricing is consumption-based, tied to API calls rather than seats, and you contract with Anthropic separately for Claude inference. Per Apex Hours, Salesforce President Patrick Stokes framed token use carefully: it is not zero, but nowhere close to a coding agent, which is the most token-hungry workload there is. That is a comparison, not a promise that it is cheap. Do not extrapolate an org-wide bill from a vendor framing. Instrument a pilot cohort, measure real token consumption against the skills your team actually uses, and get your own number before you sign anything at scale.

Everything above secures whether a write is allowed. It does not decide whether a write is correct, or whether a person approved it. Permission enforcement lives in the org and answers can this actor write this field. It cannot tell you the close date was misheard off a transcript, or the customer never actually agreed to the stage change on the call. That is the gap the audit is really about, and the fix is to gate by consequence rather than gate everything. Let reversible, low-stakes writes such as logging a call or enriching an empty field run unattended and logged, with a confidence threshold and a path to undo, so reviewers never learn to rubber-stamp. Reserve a human approval for the writes that are hard to undo, that move a forecast, or that reach a customer. This is exactly OWASP's guidance for LLM systems: its 2025 Top 10 names Excessive Agency and recommends human-in-the-loop control to require a person to approve high-impact actions. Salesforce and HubSpot landed here too, routing consequential agent writes through a human rather than firing them blind.

Steps 1 through 5 are Salesforce admin work you do once before the pilot. Step 6 is an ongoing layer, and it is the one we build. Mindlyft (ASTRA) sits on top of an engine like Claudeforce, not against it: it turns call outcomes into a drafted batch of tracked actions across the tools a CSM, SE, or TAM already uses, each carrying the line from the conversation that justifies it, staged behind one human approval and logged with the evidence. Reversible writes flow through, the consequential ones wait for a yes, and nothing lands that the account owner did not sign off on. If you are piloting Claudeforce and want the approval and audit layer in place from day one, Mindlyft runs as GTM engineering on subscription, the first workflow is free, then plans start at 5,995 dollars per month, at mindlyft.in.