Salesforce Enterprise AI Harness Explained: What IT Leaders Need to Know
Salesforce's Trusted Enterprise AI Harness adds six capabilities plus an AI Control Plane for agent governance. What IT leaders must know now.
TLDR: Salesforce’s Trusted Enterprise AI Harness, announced September 10, 2026, reframes products you mostly already own (Data 360, MuleSoft, Agentforce, Informatica) as one composable governance layer for every agent in your estate, plus a new AI Control Plane for discovering, registering, and cost-tracking agents. The catch: the Control Plane and unified experience don’t ship until early FY28 (February 2027 at the earliest), two of the six capabilities aren’t built yet, and there’s no pricing. If you’re a Salesforce shop planning agent rollouts in the next two quarters, treat this as a vendor roadmap to negotiate against, not a product to wait for.
Why This Matters Now
Salesforce made its move six days before Dreamforce 2026, and the timing tells you everything. Agent sprawl is the problem every IT leader actually has: Copilot agents in Teams, Claude skills touching CRM data, Agentforce pilots running up consumption credits, and nobody able to answer “which agents can touch customer data and what did they cost last month?” MIT’s NANDA initiative found that 95% of enterprise AI pilots fail, and governance gaps are a big reason why.
Salesforce’s answer is to stop selling agents and start selling the control layer above them. That’s a pitch aimed directly at ServiceNow’s AI Control Tower and Microsoft’s Agent 365, which went GA in May 2026 and is already sitting in your Microsoft EA renewal conversation. This article translates the six “Trusted” capabilities into operational terms, compares the Control Plane against what you can buy today, and gives you a checklist for this quarter.
The Six Capabilities at a Glance
| Capability | What it does operationally | Status (verified Sept 17, 2026) |
|---|---|---|
| Trusted Context | Grounds agents in governed Data 360 + Informatica data, metadata, semantics, memory | Foundation live today (Data 360, Informatica) |
| Trusted Agency | Reasoning, planning, orchestration with deterministic guardrails | Partially live via Agentforce; full orchestration FY28 |
| Trusted Action | Secure invocation of APIs, workflows, MuleSoft connectors | Live today (MuleSoft, Flow, Agentforce actions) |
| Trusted Governance | Lineage, data quality, policy guardrails on AI inputs | Partially live; unified policy layer FY28 |
| Trusted Security | Identity, permissions, privacy, runtime enforcement (Guardian) | Live today (Salesforce Guardian, platform sharing model) |
| Trusted Models | Intelligent model routing on accuracy, performance, cost; swap models without rebuild | Not yet built; FY28 |
| AI Control Plane | Discover, register, monitor agents; lifecycle, performance, cost control | Not yet built; early FY28 (Feb 2027 earliest) |
Sources: Salesforce press release, Sept 11, 2026 (https://www.salesforce.com/ap/news/press-releases/2026/09/11/salesforce-introduces-the-trusted-enterprise-ai-harness/); Salesforce Ben analysis (https://www.salesforceben.com/salesforce-introduces-the-trusted-enterprise-ai-harness/).
Trusted Context and Trusted Agency: The Data Story
Trusted Context is the piece Salesforce can defend better than anyone. Data 360 harmonizes customer records, Informatica (a Salesforce acquisition) handles lineage and data quality, and the platform’s metadata layer carries the semantics of what fields actually mean. When Salesforce demos the “Can we fulfill this order today?” scenario, Context is what assembles the customer, contract entitlements, inventory, and the business definition of “available” into one grounded picture.
Trusted Agency is the reasoning layer: planning, state, memory, multi-agent orchestration, with deterministic controls where the business can’t tolerate probabilistic guessing. Order promising is the canonical example. You don’t want an LLM vibing on whether inventory exists.
What works
The context argument is real. Models don’t understand your business, and Salesforce platform chief Rohan Kumar said exactly that in the press briefing: models are trained on the open internet, not on your customers, products, entitlements, and interaction history. Few vendors sit on as much operational business data as Salesforce does. If your customer master already lives in Data 360, grounding agents there beats building a parallel vector store your data team has to govern separately.
Where it struggles
But here’s the catch: Context only compounds if your Data 360 implementation is healthy, and most aren’t. In my experience with Salesforce orgs carrying years of technical debt, harmonization coverage stalls below 70% because nobody funded the data stewardship role. An agent grounded in 70% of your customer data is confidently wrong about the other 30%.
Earned insight: The “fulfill this order today” demo assumes CRM, ERP, contracts, and analytics all flow into one context layer. In the three Salesforce orgs I’ve seen attempt Data 360 harmonization across ERP boundaries, the ERP connector was the piece that slipped every timeline by two quarters. Budget the integration before you budget the agents.
Trusted Action and Trusted Models: The Execution Story
Trusted Action is MuleSoft plus Flow plus Agentforce actions under a new name: the secure path from “the agent decided” to “the work got done,” with outcomes flowing back into Context. This creates what Salesforce calls a compounding intelligence loop. Every fulfilled order enriches the memory the next agent reasons over.
Trusted Models is the forward-looking bet: route each task to the right model on accuracy, performance, and cost, and swap models without rebuilding agents. Kumar was blunt that agent code is becoming a commodity. The durable asset is proprietary context, not model choice.
What works
Model routing is the right abstraction. OpenAI cut agent model costs by up to 80% this summer and Google cut Gemini agent costs 65%, so any architecture that hard-codes a single model is a procurement liability. A routing layer that lets you chase falling inference prices without rebuilding is genuinely valuable.
Where it struggles
The problem is that Trusted Models is one of the two capabilities Kumar admitted isn’t built yet. You’re being asked to bet your model-flexibility strategy on a FY28 roadmap item while Snowflake’s Cortex AI Gateway and AWS Bedrock AgentCore already route across models today. Roadmaps aren’t products.
Warning: Salesforce confirmed “additional details on availability, packaging, pricing, and upgrade paths will be announced closer to general availability.” Translation: nothing here has a SKU. Don’t let your AE attach Harness line items to a Q4 order as anything other than a price-hold or future-credit clause.
Trusted Governance and Trusted Security: The Control Story
Trusted Governance covers lineage, data quality, and policy guardrails on what AI relies on. Trusted Security applies identity, permissions, privacy, and runtime enforcement through Salesforce Guardian and the platform sharing model. Together they’re the answer to “the agent only sees what it’s authorized to see and only does what policy allows.”
What works
Inheriting the Salesforce sharing model is a genuine advantage over bolt-on agent security startups. Your record-level access rules, field-level security, and audit trails already exist. Agents running inside the platform get them for free instead of requiring a parallel permission system your security team has to certify separately.
Where it struggles
What nobody tells you: the sharing model only covers data inside Salesforce. The moment an agent touches ERP inventory, Snowflake tables, or a third-party API through MuleSoft, you’re back to connector-level credentials and whatever governance the source system enforces. Cross-system authorization is the actual hard problem, and the Harness doesn’t solve it until the Control Plane ships.
Earned insight: Every agent governance demo I’ve watched, from any vendor, shows the happy path inside one platform. Ask this question on every call: “Show me the audit trail when the agent reads a record in Salesforce, calls an SAP BAPI, and writes to Snowflake, in one trace.” Nobody has a clean answer yet. Salesforce included.
The AI Control Plane Is the Actual Product
Strip away the six-capability framing and the thing Salesforce is really selling is the AI Control Plane: one place to discover and register agents, assign identity and policy, manage lifecycles, evaluate performance, observe behavior, and control cost across Salesforce and third-party AI. MuleSoft Agent Fabric (GA January 2026) was the first draft. The Harness consolidates it with five other product lines into one story.
But the Control Plane is where the competitive gap is widest. Here’s the honest comparison:
| Dimension | Salesforce AI Control Plane | Microsoft Agent 365 | ServiceNow AI Control Tower |
|---|---|---|---|
| Status | Early FY28 (Feb 2027 earliest) | GA since May 2026 | Available 2026 |
| Agent registry | Planned | Shipping (single registry + Agent Store) | Shipping |
| Third-party agents | Promised (Claude, Teams named) | Shipping (Box, Workday, Salesforce, ServiceNow agents) | Shipping (multi-vendor) |
| Cost tracking | Planned | Shipping | Shipping |
| Data grounding | Strongest (Data 360 + Informatica + metadata) | Weaker outside M365 graph | Strongest in ITSM/workflow data |
| Headless access | MCP, APIs, Skills, plug-ins (planned) | APIs, connectors | APIs, Spokes |
| Pricing | Unannounced | Bundled in M365 E-tiers | Consumption-based |
Sources: Microsoft 365 Blog, Nov 2025 (Agent 365 control plane announcement); TechTarget, Sept 11, 2026 (Harness vs ServiceNow analysis); Kosmoy agent governance comparison, July 2026.
Salesforce Harness strengths:
- Deepest customer-data grounding of any control plane vendor
- Headless-first design (MCP, APIs, Skills) means agents surface in Claude, Slack, Teams, not just Salesforce UI
- Composable packaging philosophy: take what you need, bring your own security vendor
- Doesn’t require full Salesforce stack, per analyst Brent Leary (CRM Essentials): viable for MuleSoft/Slack-only shops
Salesforce Harness weaknesses:
- Control Plane ships 9+ months after Microsoft’s GA product
- Two of six capabilities admitted unbuilt; no pricing, no packaging, no upgrade SKUs
- Cross-system authorization story is aspirational until Control Plane lands
- Announcement is pre-Dreamforce positioning; expect GA dates to slide with demos
Microsoft Agent 365 strengths:
- Shipping today with registry, Agent Store, and cost controls
- Horizontal coverage across identity (Entra), productivity (M365), and third-party agents
- Already in your EA renewal; procurement friction is near zero
Microsoft Agent 365 weaknesses:
- Grounding outside the M365 graph is thinner than Salesforce’s Data 360 story
- Microsoft-first gravity: non-Microsoft surfaces are second-class citizens
- Governance depth on lineage and data quality lags Informatica-backed tooling
Earned insight: The contrarian read nobody in the top-10 coverage states plainly: this announcement inverts Salesforce’s historic bundling model. Brent Leary’s observation is the tell. A headless, composable Harness that works for non-Salesforce shops means Salesforce is conceding the suite war and fighting for the control layer instead. That’s a bet that Agent 365 and Control Tower forced on them, and it means your negotiating leverage as a partial-Salesforce shop just went up.
Pricing Reality
There is no Harness price because there is no Harness SKU. What you can budget around today:
| Cost element | What we know (verified Sept 17, 2026) |
|---|---|
| Foundation products | Data 360, MuleSoft, Agentforce, Tableau, Guardian: existing licenses, existing price books |
| Agentforce consumption | Agentforce runs on consumption credits (Flex Credits); 30,000 customers and 7B actions delivered per Dreamforce 2026 keynote figures. Model your pilot burn before committing. |
| New capabilities + Control Plane | No pricing announced; “upgrade eligible investments” language suggests uplift on existing SKUs, FY28 |
| Implementation | Data harmonization and MuleSoft connector work dominate TCO; ERP connector timelines slip 1-2 quarters in practice |
| Hidden cost | Shadow agent spend: Copilot, Claude, and Agentforce credits billed through three different owners with no consolidated view until a control plane ships |
Tip: Before your next Salesforce renewal, demand a written price-hold tying your current Data 360 and Agentforce spend to Harness upgrade entitlements. Salesforce’s own “existing customers will be able to upgrade eligible investments” line is your leverage. Get “eligible” defined in writing now, while the packaging team still needs design wins.
Who Should Pay Attention (and Who Shouldn’t)
Good fit if you match this profile:
- You’re a Salesforce-heavy shop with Data 360 already licensed and Agentforce pilots running. The Harness is your roadmap, and you should align architecture decisions to it now.
- Your CISO is asking for an agent inventory and you have nothing. Use the announcement as budget justification for a discovery exercise this quarter, even if the tooling comes from Microsoft or ServiceNow first.
- You run MuleSoft or Slack without the full Sales/Service Cloud stack. The composable, headless framing means this story applies to you for the first time.
Not a good fit right now:
- You need a working agent registry and cost controls before Q2 2027. Buy what’s shipping: Agent 365 if you’re M365-heavy, Control Tower if you’re ServiceNow-heavy.
- You’re a small team with two Agentforce pilots and no sprawl problem. Six capabilities and a control plane are overhead you don’t need yet.
- You’re expecting Dreamforce demos to equal GA software. Salesforce’s own fine print says base purchasing decisions on currently available products.
Bottom Line
The Trusted Enterprise AI Harness is Salesforce’s most honest architecture statement in years: the model is a commodity, your proprietary context is the moat, and governing agents across vendors matters more than building more of them. The six-capability framing is mostly new packaging on products you can buy today, but the packaging reveals strategy. Salesforce is fighting for the control layer, headlessly, against Microsoft and ServiceNow.
The single biggest tradeoff is time. Everything genuinely new, the Control Plane, model routing, the unified experience, lands February 2027 at the earliest with no pricing attached. Your agent sprawl, shadow spend, and audit gaps exist this quarter.
Your 30-day action: run a two-week agent inventory. Catalog every agent touching enterprise data, who owns it, what credentials it holds, and what it cost last month. Use our Enterprise AI Agent Evaluation Framework to score them, and take the inventory into your next Salesforce, Microsoft, and ServiceNow renewal conversations.
Frequently Asked Questions
Does the Enterprise AI Harness replace Agentforce?
No. Agentforce is the agent builder and runtime; the Harness is the governance and context layer those agents (and third-party agents) run inside. Salesforce positions them as complements: Agentforce delivers the 30,000-customer installed base and 7B executed actions, while the Harness adds cross-vendor registration, policy, and cost control. If you’ve invested in Agentforce pilots, the Harness extends that investment rather than stranding it. The risk is sequencing, since the Harness layer your pilots will eventually be governed by doesn’t ship until FY28.
When will the AI Control Plane be generally available?
Salesforce says new capabilities and the unified experience “begin rolling out in early fiscal FY28,” which means February 2027 at the earliest given Salesforce’s fiscal year starts February 1. That’s a start-of-rollout, not a GA date for all features. Salesforce Ben’s practitioner analysis reaches the same conclusion. Treat any Dreamforce 2026 demo as preview software. If your governance timeline can’t wait 6-12 months, evaluate Microsoft Agent 365 (GA May 2026) or ServiceNow AI Control Tower, both shipping today.
How is the Harness different from MuleSoft Agent Fabric?
Agent Fabric, which went GA in January 2026, was positioned as an “agentic control plane” for discovering and governing agents across MuleSoft-connected systems. The Harness absorbs Agent Fabric as one input among six product lines (adding Data 360, Informatica, Tableau, Agentforce, Guardian, and the platform) and adds the model-routing and unified-experience layers. Think of Agent Fabric as the first draft of the Control Plane concept, now folded into a bigger architecture story with a later ship date.
Does the Harness work with non-Salesforce tools like Claude and Microsoft Teams?
That’s the explicit promise: headless access via MCP, APIs, Skills, and plug-ins, with Claude, Slack, Microsoft Teams, and Agentforce named as surfaces. The Salesforce-in-Claude (Claudeforce) Sales Cloud skill, released as a free open beta at Dreamforce 2026, is the first proof point. But cross-vendor depth is unverified until the Control Plane ships. Analyst Brent Leary notes the Harness may fit organizations that aren’t full Salesforce shops, which would be a genuine break from Salesforce’s bundling history if the packaging follows through.
How much will the Enterprise AI Harness cost?
Unknown. Salesforce has announced no pricing, packaging, or upgrade SKUs, stating details will come “closer to general availability.” Expect uplift pricing on existing Data 360, MuleSoft, and Agentforce investments (“upgrade eligible investments” language). The real TCO driver won’t be the Harness SKU itself but the foundation work: Data 360 harmonization, MuleSoft connector builds (especially ERP, which routinely slips 1-2 quarters), and Agentforce consumption credits. Get price-hold language in your current renewal before FY28 packaging lands.
How does this compare to Microsoft Agent 365 for governance?
Agent 365 is the buy-today alternative: GA since May 2026, with a shipping agent registry, Agent Store, and cost controls, already inside your Microsoft EA. Salesforce’s answer is deeper customer-data grounding (Data 360 + Informatica + metadata vs. the M365 graph) and a headless design that meets users in Claude and Slack. Microsoft wins on availability and procurement friction; Salesforce’s case rests on data depth and openness. If you’re M365-heavy with light Salesforce usage, Agent 365 is the pragmatic pick. If your customer master lives in Salesforce, align architecture to the Harness while governing today’s sprawl with what’s shipping.
What should IT leaders do this quarter?
Three things. First, run a two-week agent inventory: every agent touching enterprise data, its owner, credentials, and monthly cost. Second, freeze any architecture decision that hard-codes a single model vendor, since model routing (from someone) is coming and inference prices are still falling 60-80% per cycle. Third, use the Harness announcement as leverage in renewals: demand written definitions of “eligible investments” for upgrade paths and price-holds on Data 360 and Agentforce spend. Don’t pause agent pilots waiting for FY28, but don’t sign multi-year consumption commits without Harness-linked protections either.
Related Articles
Discussion