1. What is Salesforce Agentic Identity?
Salesforce Agentic Identity is a registration system the company plans to launch in November 2026, under which customers must register any external AI agent that reaches the platform through its APIs or its Model Context Protocol (MCP) servers. Each registered agent gets its own identity and narrower permissions than a typical human user, and customers can monitor agent access. Salesforce has not disclosed pricing.
The change turns what has so far been an informal arrangement into a managed one. Until now, an outside program that wanted to read or write customer records could often do so by borrowing the access of an existing user. Under the new approach, the agent itself becomes a named participant that the platform can recognize, limit and audit.
The move sits inside a wider set of upgrades that Salesforce groups under its Headless Toolkit and AIforce branding. Those upgrades aim to make the platform usable by software as well as by people, and registration is the control layer that is meant to keep that access orderly.
2. What does headless access mean, and where does MCP fit in?
Headless access describes software using a platform directly rather than through its on-screen interface. A typical example is an AI agent that retrieves customer records through an API with no person clicking through menus. Because nobody is looking at a screen, the usual human checkpoints, such as a login prompt or a visible approval step, are absent unless the platform builds them in some other way.
MCP is a standard connector that lets AI agents reach external tools and data sources in a uniform manner. Instead of writing a custom integration for every pairing of agent and service, developers can point an agent at an MCP server and let it discover what it is allowed to do. Salesforce operates MCP servers of its own, and the registration requirement applies to external agents that connect through them as well as to those that call its APIs directly.
An API, or application programming interface, is the long-established way for one program to ask another for data or to request an action. Many companies have used Salesforce APIs for years to connect their billing, marketing and support systems. What has changed is the kind of caller. A conventional integration performs a fixed, predictable routine, while an AI agent decides at run time which requests to make, which makes its behavior harder to forecast and therefore harder to govern with static rules.
Together, APIs and MCP servers are the two main doors through which outside agents can enter the platform. By placing registration in front of both, Salesforce is addressing the entry points that automated tools are most likely to use.
3. How would registered agents be handled?
Every registered agent would be treated as a distinct entity rather than as an extension of a human account. That has two practical effects. First, the permissions granted to the agent can be scoped to the specific tasks it performs, instead of inheriting the broad access that a person in a given role might hold. Second, the activity of the agent can be traced back to it by name, which gives administrators a record of what each one did.
This is a familiar principle in security, usually called least privilege: any user or program should hold only the access needed for its job. Applying it to agents means an assistant that drafts sales emails does not also need the ability to export an entire customer database. Registration gives administrators a defined moment at which that decision is made, before the agent starts work, rather than after a problem appears.
The narrower permission model matters because a human user and an automated agent behave differently. A person typically opens a handful of records during a working day. An agent can issue thousands of requests in minutes, and a misconfigured one can read or change far more data than anyone intended. Limiting what each agent may do reduces the damage that a mistake or a compromised credential can cause.
Customers will also gain monitoring tools that show which registered agents are accessing the platform. For companies that have connected several outside assistants to their Salesforce data, that visibility is the main practical benefit of the program, since it answers the basic question of which bot touched which information.
4. Why is Salesforce calling this a response to agentic sprawl?
Salesforce describes the underlying problem as "agentic sprawl": as AI agents multiply, it becomes hard to keep track of which of them has access to which data. Each team inside a company can connect a new assistant, and each assistant may carry its own credentials, so the number of automated actors grows faster than the records that describe them.
Registration is presented as the remedy. By making each agent a named and permissioned entity with a traceable activity record, Agentic Identity adds accountability that is difficult to reconstruct after the fact. If a customer record is changed unexpectedly, an administrator would be able to see which registered agent was responsible instead of searching through generic user logs.
Companies that handle regulated data have an extra reason to care. Customer records often include contact details, contract terms and payment history, and organizations may be asked to show who or what accessed them. An agent that acts under a shared or borrowed login leaves an ambiguous trail, while a registered one leaves a trail that points to a single identifiable actor.
The idea mirrors long-standing practice for people and for conventional software integrations, where accounts, roles and audit trails are standard. What is new is applying the same discipline to autonomous agents, which operate continuously and make decisions without a person approving each step.
5. How do Flex Credits connect to the registration requirement?
Registration also lays the groundwork for charging for outside AI activity. Salesforce is moving toward billing headless interactions through Flex Credits, its consumption-based currency, so that each interaction from a registered external agent could eventually draw down credits. A platform cannot meter activity it cannot identify, and registration supplies the identification.
Costs have not been set, and the exact pricing structure is not final. No charges apply until Salesforce updates its Flex Credit rates, and that update is expected only after customers receive a 30-day notice. The most important unknown for customers is therefore the rate that will apply to each interaction, which will determine how expensive it becomes to run outside agents against their own Salesforce data.
Consumption pricing differs from the seat-based licensing that many software buyers know. With seat licensing, a company pays per person regardless of how much each person uses the product. With metered pricing, the bill follows activity, so a busy automated agent can cost far more than a quiet one. That difference explains why the missing rate is the detail customers are watching most closely, and why the 30-day notice period matters as a planning window.
Until the figures are published, companies cannot calculate the bill that a given workflow would generate. A process in which an outside agent reads a few records is cheap to imagine. One in which many agents query the platform all day is harder to price without a rate.
6. What could this mean for customers?
The principal concern for customers is cost. Businesses that have built workflows around outside AI tools may find that activity which was previously unmetered becomes a line item they did not budget for. Companies that rely on third-party agents to summarize accounts, draft updates or move data between systems have the most to examine.
Procurement and finance teams may also want a say. When outside agents become metered, the choice of which assistant to connect is no longer only a technical decision, because each connection carries a possible recurring charge. Companies may need to decide who inside the organization can approve a new agent and how its usage will be tracked against a budget.
There is a security upside as well. A register of approved agents, each with limited permissions, makes it easier to answer auditors and internal risk teams who ask what automated software can see. Organizations that already maintain such an inventory will find the transition simpler than those that have connected tools ad hoc.
For the vendor, the arrangement shifts outside agents from being unpaid visitors to being measurable users of the platform. That is the commercial logic that sits beside the governance argument, and it explains why customers are likely to scrutinize the pricing once it appears.
7. What happens next?
Agentic Identity is scheduled to launch in November 2026. After that, the most consequential event will be the Flex Credit rate update, which has no date yet. Once Salesforce issues its 30-day notice, customers will learn what a registered external agent costs per interaction.
The episode also shows how quickly the rules around AI agents are being written by the platforms that host them. As more software acts on behalf of people, the vendors that hold the data are deciding who may connect, under what identity and at what price. Salesforce is one of the first large business-software providers to tie those three questions together in a single program, and its customers will be the first to see how the terms work in practice.
In the meantime, administrators can prepare by listing the outside agents that already connect to their Salesforce environments, identifying the data each one needs, and estimating how often each calls the platform. Those three inputs will let a company measure its exposure once prices are published and decide which agent workflows are worth their metered cost.