An agent can reason about when to perform work, but business side effects should run through explicit actions. Flows package deterministic automation; action definitions make that automation understandable to the agent; permissions set the outer boundary.
These layers must agree. A well-described action without the right permissions fails at runtime, while broad permissions behind a vague action create unnecessary risk.
Design a narrow write path
- Create small, single-purpose actions with names and descriptions that clearly state when they should be used.
- Expose only the inputs and outputs needed for the decision and user response.
- Validate business limits inside Flow, Apex, or platform rules instead of trusting generated arguments.
- Grant the agent user the minimum object and field permissions required by the approved action.
Make the action production-ready
- Define success, validation failure, integration failure, and timeout outputs.
- Test the action directly before testing whether the agent selects it correctly.
- Verify permissions and active Flow versions in the target environment after deployment.
- Trace inputs and outputs while preventing secrets or unnecessary personal data from entering logs.
Resources
This article is based on the following Salesforce learning and product documentation.