Business limits outlive the session.
Apply the rule to the quote, case, or customer. A new conversation should not reset the limit—or erase what was already committed.
Use cases / Salesforce
Let Agentforce act.
Keep the final say.
Give Agentforce more useful work—not open-ended authority. Govern business commitments inside Salesforce with business-owned policy, named approvals, and evidence of what changed.
One org is enough. Multi-cloud is optional.
Sample data
HOLD FOR APPROVAL
The exception needs an owner.
A 25% discount needs a sales manager. The quote stays unchanged while the request is reviewed.
Held until a manager decides; an approval does not release it.
Policy
commercial-discounts · Sales-manager review required
Approval
Pending · Sales Manager
Salesforce
NOT DISPATCHED · QUOTE UNCHANGED
session 01 · no Salesforce connectionInspect this decision
Test the boundary
Approval and execution are separate steps. Changes persist until Reset.Open the decision record
Deep Salesforce integrationAgentforceFlow & ApexEinstein BotsSalesforce APIsMuleSoft & MCP
The single-platform case
Even if every agent you run is in Salesforce.
Your platform strategy can stay Salesforce-first. An agent can change a commercial commitment without leaving your org. GovernorAI gives the business a repeatable way to own that authority—from the reviewed workflow to the record change.
The exception goes to its owner.
Hold the exception for a named approver and record the decision. An approval does not release the call, and a changed request is a new request.
Evidence follows the actual change.
Connect what was approved for production, why an action was allowed, who reviewed it, and what Salesforce actually updated.
Your agent can request authority. It cannot grant itself authority.
ONE AGENT · ONE ORG · ONE ACCOUNTABLE WORKFLOWOne discount, end to end.
In this example, the discount rule is managed in GovernorAI and enforced by the GovernorAI action gate in your org.
- Salesforce In this example, the configured permission sets let the Agentforce agent update the quote, and the Einstein Trust Layer governs the data and the prompt.
- GovernorAI For an enrolled agent, the GovernorAI action gate (Apex) applies the discount policy before the update runs. 25% on a $120,000 quote needs a sales manager, so the gate holds it; above 30% is denied.
- Manager The named sales manager approves or rejects.
- Record The record carries the policy and rule that decided and the outcome, independent of the org's own audit.
And when it is not only Salesforce: one policy, one ledger, one evidence chain across Salesforce, ServiceNow, AWS, Azure, Google Cloud, Databricks, Kubernetes and MCP. See how one policy governs everywhere
In the product
See Salesforce agent decisions in the console.
Recorded on a demo tenant: one governance policy previewed for two providers, every agent on one map, and one decision log with Salesforce Agentforce, ServiceNow and cloud agents side by side.
One policy, step by step
Real product screens from a demo tenant with seeded activity. The provider outputs are previews of what the policy becomes for each target; nothing was applied.
Recorded against a demo tenant with seeded activity. Real product screens, not a mock-up.
Your rules, inside one org
Same quote. Three requests.
Your rules.
Agentforce proposes a discount on a $120,000 quote. Routine work proceeds. A sales manager reviews the exception. A hard limit stays a hard limit.
01 / Hard limits first.
Above 30% is denied. An approval cannot override it.
02 / Exceptions wait for a person.
The quote is held for a named sales manager. The decision is recorded; it does not release the update.
03 / Routine work keeps moving.
Up to 10% can proceed. Salesforce permissions still apply.
Illustrative data. No Salesforce connection. Try the three requests in the example above
Coexistence
Keep your Salesforce controls.
Connect the whole workflow.
The reason to add GovernorAI is not that Salesforce lacks governance. It is to bring the business rule, its owner, the approval decision, and the execution record into one independently managed process.
Keep your native foundation
Salesforce remains the system of work.
Permissions and sharing. Keep the access boundaries already protecting your org.
Deterministic actions and workflows. Keep the business logic and action orchestration you have built.
Native guardrails and telemetry. Use existing security controls and activity records.
Add GovernorAI
The business owns the authority.
A reviewed mandate. Connect the agent’s approved role to a policy owned by the business.
An accountable exception. Put the precise request with its authorized reviewer—not the agent.
A connected outcome. Keep the matching policy, approval, and Salesforce result together.
Could you build this around native services? Yes. GovernorAI packages the governance lifecycle so your team can focus on the workflow, not maintaining the surrounding approval logic and evidence process.
The evaluation is practical: how well are limits enforced, how easily can owners review exceptions, and how much work does it take to explain the result?
More than a runtime checkpoint
Approve the workflow.
Keep it governed as it changes.
A new tool, agent version, or deployment should not disconnect production from what your team reviewed. One policy record connects the entire lifecycle—even in one org.
Discover
Find the agent, its actions, its owner, and the paths that need protection.
Assure
Test the pinned workflow against the business requirements before rollout.
Govern
Publish the reviewed policy, its owner, and the rules for exceptions.
Enforce
Apply the decision at the required action boundary. Recheck before execution.
Prove
Link authority to the result. Track changes and make the record reviewable.
ONE REVIEWED POLICY RECORDcommercial-discounts / rev 4renewal-agent@12Sales Operations owns the rule
Independence is about ownership. Not platform count.
Agent builder
Defines what the workflow can do and submits it for review.
Business owner
Owns the limits, policy changes, and authority to approve exceptions.
Evidence reviewer
Follows the tested workflow, authorization, and actual result.
Fits the Salesforce you already run
Govern inside the org.
Extend beyond it when ready.
Start with a native Salesforce workflow. The action requires a policy decision before it runs. External agents can use a governed API or MCP path as your needs expand.
Start here / native action gate
Agents inside Salesforce
Agentforce, Flow, and Apex use a required action gate. GovernorAI returns the decision; Salesforce executes the authorized operation.
Agentforce proposes an actionQuote + discount + trusted actor
↓ native action gate · before the action runs
↓ valid authority + native permissions
Salesforce updates the recordActual result is correlated
Not another optional tool. The governed operation requires authorization. The model does not decide whether to obey it.
Expand when needed / governed API route
Agents calling Salesforce
Agents outside your org use a governed API or MCP route before their requests reach Salesforce.
External agent requests an actionAPI or MCP
↓ governed API route · before the request reaches Salesforce
↓ Salesforce permissions still apply
Salesforce executesResult joins the action record
Same business-policy approach. Keep ownership, approval, and evidence connected across execution paths.
The native check evaluates selected action context; it does not execute the action. The external path governs forwarding. Configure data handling and credentials for the chosen path.
Map your action boundaryAuthority → actual outcome
Show why it ran.
Show what it changed.
Approval is not execution. Connect the exact request, matching policy, reviewer, and Salesforce result—while keeping enforcement coverage visible.
Current demo / decision record
HOLDOne request. One reviewable story.
- 01 / REQUEST
- Q-1042 · 25%Proposed value: $90,000
- 02 / POLICY
- commercial-discountsManager review required
- 03 / APPROVAL
- Pending · Sales Manager
- 04 / EXECUTION
- Not dispatchedQuote unchanged
Preparing sample record…
Illustrative, unsigned event bundle. Hash links do not prove source authenticity or a real Salesforce update.
Inspect the sample JSON
Preparing…
Coverage / illustrative inventory
1 orgKnow what is actually governed.
Discovery is the starting point. Reconcile the assigned policy with the deployed action boundary, so a removed gate does not remain “governed.”
Renewal quote updateRequired action gate verified
EnforcedCase summaryActivity visible; gate not enabled
ObservedNew bulk-update actionFound; protection not yet assessed
DiscoveredRestricted action pathInsufficient visibility to verify
UnknownExample scope: 4 identified paths · 1 verified enforced.
Unknown coverage is not counted as protection.
No reconstruction from screenshots. Keep the decision and result together. An uncertain execution stays unknown until it is reconciled.
Additional reach. Not an entry requirement.
Start where you are.
Govern wherever you grow.
Prove the value on one Salesforce workflow. Extend the same business-policy, approval, and evidence approach across clouds, SaaS, and private infrastructure as your needs expand.
Single-cloud, multi-cloud, hybrid—your choice.
Business authority stays the constant.
SalesforceStart with one org
AWSCloud agents
Google CloudCloud agents
AzureCloud agents
DatabricksData & AI
ServiceNowSaaS workflows
Private infrastructure & hybrid environmentsExpand on your terms
Before the briefing
Good questions.
Direct answers.
We only use Salesforce. Why add GovernorAI?
Because the value starts with governing the business action, not connecting a second platform. GovernorAI brings business-owned limits, named approvals, policy continuity, and execution evidence into one workflow. Start with an Agentforce quote change inside one org.
Why not just use Salesforce’s native governance?
Keep it. Salesforce already supports permissions, deterministic actions, and governance controls. GovernorAI connects the reviewed business mandate, accountable owner, approval lifecycle, and actual outcome into an independently managed process. Evaluate the difference on control fit, reviewer effort, and maintenance of your real workflow.
Do approvals require Slack, Teams, or another application?
No external messaging application is required for the proposed workflow. The owner can review in GovernorAI or a supported Salesforce review surface. Chat and ticketing integrations are optional. The demonstration’s approval happens here, without connecting to an approval service.
Can an approval override a hard limit—or a Salesforce denial?
No. An approval records a decision on an eligible exception; it never applies to a prohibited action, and it does not release the held call. A changed quote, discount or context is a new request. Native Salesforce permissions remain binding.
Does this mean rebuilding our agents?
Start with one consequential action and connect a required execution gate. Keep the agent’s useful workflow and native controls; configure the action path, identity, and credentials so each enrolled agent’s governed operation runs only after authorization. The briefing maps that path, and agent enrolment, in your org.
What happens if GovernorAI is unavailable?
Consequential writes and sensitive-data access do not execute without valid authority. Any continuity exception must be explicitly approved, narrowly scoped, and recorded. A read-only action is not automatically safe to let through.
Does the check process our Salesforce data?
The native check uses selected action context, which can include record identifiers and relevant arguments. Configure field selection, processing location, redaction, retention, and credential handling for the deployment. Decision-only describes who executes the action; it does not mean no data is processed.
One workflow. A clear proof of value.
Give your next Agentforce workflow the authority to act.
Bring one Salesforce workflow and the person who owns its business rules. Leave the briefing with a clear governance plan and a scoped evaluation path.
Continue
Govern EverywhereOne policy across your AI stack Runtime EnforcementDecide at the action boundary Evidence & ComplianceHash-chained audit record, mapped to controls Policy & GovernanceOne policy, from intent to evidence ServiceNowWorkflow check, before-write rule GRCEvidence chains and control mapping