We've started seeing it on client sites in the last few months. Not a pilot in a lab, not slide-ware. Actual Salesforce Trailblazers quietly wiring Claude directly into Salesforce and getting real work out of it.
On 26 August, Salesforce and Anthropic gave the arrangement a name, Claudeforce, and three weeks out from Dreamforce they're clearly about to turn the volume up. Claude is now a first-class citizen inside the Salesforce trust boundary, and thanks to Headless 360 and their new MCP (Model Context Protocol) capability, more or less everything in your Salesforce org is now something an agent can read and write to.
BUT – now that an agent that can do everything in your org, it can also do everything in your org! The only thing standing between "brilliant" and "incident" is the layer you put in the middle. Which most people are about to skip.
---
Claude + Salesforce use cases
Let me be specific, because the use cases are genuinely rad and I don't want to sound like I'm being a negative nelly.
Use Case #1: Slackbot – uses Anthropic APIs in the background (not Agentforce). Slackbot is the agent within Slack that has full context across Salesforce, as well as your other ecosystem apps, like Atlassian, Google, Microsoft etc. I've seen AEs demo their own use of Slackbot to clients, and it sparks gasps and conversation. The best thing – Slackbot is easy to implement and even easier to use.
Use Case #2: Tag Claude in Slack – This was a recent cool feature released, you can now access Claude from within Slack to enable Slack to be THE surface to get work done anywhere.
Use Case #3: Claude for Salesforce Development – Claude writing Apex, building Flows, generating Lightning Web Components, untangling a validation rule someone wrote in 2019 and documenting the undocumented. This is where the productivity is most obvious and the risk is most contained, because you can muck around in a sandbox, keeping an air gap between it and prod.
Use Case #4: Claude for Marketing Cloud Engagement Super Users – building and QA-ing journeys, writing content, SQL, AMPscript, reporting, the works. Asking plain-English questions of send data and journey performance instead of waiting on someone fluent in SQL.
For a lot of marketing teams this is the first time the data's actually been legible to them.
Use Case #5: CRM End Users (Sales & Service) – This is the thing that makes Claudeforce different: live data with governed action. The new Salesforce in Claude plugin ships with 37 prebuilt sales skills, so a seller can run deal health, pipeline review and meeting prep, and take action, without opening Salesforce at all. I expect Service and Marketing skills will soon follow.
Open beta's flagged for September. Claude is now the reasoning model behind the Atlas Reasoning Engine, and it powers Agentforce Coworker and Agentforce Vibes by default.
---
Why "just let them go nuts" is a bad idea
An admin wants to move fast, so they connect Claude to the org through their user profile that happens to have Modify All Data. They ask it to tidy up duplicate accounts. It does, enthusiastically merging a few thousand records across production, some of which weren't actually duplicates. No undo button. No backup. No rollback. No history.
That's the whole problem with connecting frontier intelligence straight to your system of record: the agent is bound by the permissions you gave it and nothing else.
If you give it god-mode permissions, you've built a god-mode agent, and you've done it with a tool that acts faster than you can read, states everything with total confidence, and writes to live customer data. Speed, confidence, write access and no audit trail is not a productivity story. It's an incident with a press release.
I would also expect a consumption cost in the near future. Claude runs on consumption, Salesforce is moving rapidly to consumption. The harder the agent works, the more it will cost, so an ungoverned agent looping over your org isn't only a data risk, it's a billing one.
---
The harness in the middle
Regular readers know I go on about harnesses, so I'll spare you the rant and get straight to the point.
The best practice is not to connect Claude directly to Salesforce. You connect Claude to a harness, and the harness connects to Salesforce. That middle layer is the game.
A real harness does four things. It runs under an identity: every connection executes as the authenticated user, via OAuth with PKCE, so per-user permissions and the audit trail are preserved rather than bypassed. It enforces least privilege: object permissions, field-level security and sharing rules are the real guardrails, and you build a permission set from scratch for the agent's documented job, granting only what that job needs, not inheriting some human's kitchen-sink profile.
MuleSoft has a fresh off the boat product called "Agent Fabric" which pushes that least-privilege enforcement right down to the individual MCP tool call. It logs everything: Event Monitoring captures every API call, which client, which user, which object, which operation and when, so you can reconstruct exactly what the agent did. And it separates reading from writing, because surfacing and drafting is low-risk and merging production records is not, and those two things should never sit behind the same open door.
Salesforce's own line on this is the best sentence in the whole launch, and it's not the flashy one: "Headless doesn't mean ungoverned. It means that the governance is yours to build."
Read that twice.
---
What to expect at Dreamforce?
Dreamforce runs 15–17 September in San Francisco, and after eighteen months of Agentforce branding the pressure is on to prove it works.
Expect next-generation Agentforce live on stage, expect Claudeforce and Headless 360 to be everywhere, and expect the trust-boundary story, Claude's traffic contained inside Salesforce-managed VPCs, actions adhering to the controls you already run, the ability to trigger native Agentforce actions from inside Claude, to do a lot of the heavy lifting.
That last capability, taking action in Salesforce from a conversation in Claude, is the one to watch, because it's also the one with the sharpest edge.
---
Before you connect Claude to Salesforce
Here's the order of operations I'd run:
- Don't give it a full-access user permissions. Build a dedicated permission set from scratch, least privilege, scoped to the agent's actual job. If it doesn't need the field, restrict it. If it doesn't need the object, remove it.
- Split read from write. Let it read, summarise and draft freely. Gate every write, and keep a human on anything that mutates a production record.
- Turn on logging before go-live, not after. Event Monitoring is a must. Ensure field history tracking is turned on for the objects that matter. Design the audit trail before you need it.
- Start in a sandbox, one team, clean data. Prove the harness holds on a contained use case before you let it anywhere near the whole org.
- Keep regulated data inside the trust boundary. If it's financial services, health or anything sovereign, run Claude through Bedrock inside the Salesforce trust boundary so the traffic never leaves your VPC.
None of that is glamorous. It's the same unsexy foundation work I've been banging on about for years.
---
I'm not telling you not to do it. You 100% should connect Claude to Salesforce, but you shouldn't do it willy nilly.
The power is real, the use cases are real, and the teams that get this right are going to run rings around the ones still raising tickets. Claude connected to Salesforce is a genuine force multiplier.
But Claude connected to Salesforce with the gate left open is a very fast way to discover which of your integration users had Modify All Data. The difference between those two outcomes isn't the model, and it isn't the CRM. It's the harness in the middle, and unlike the models and the licences, that part doesn't come in the box.
Drive the horse. Don't let it drive you.
---
Have you already connected Claude to Salesforce? Tell me about your experience in the comments.
---
Sources
- Salesforce, "Salesforce and Anthropic Announce Claudeforce: The #1 AI Meets the #1 AI CRM" (26 Aug 2026) – Salesforce in Claude, 37 prebuilt skills, Atlas Reasoning Engine, Agentforce Coworker and Vibes, trust boundary, beta timing. (accessed 27 Aug 2026)
- Salesforce, "Salesforce and Anthropic Bring Trusted Business Context and AI Actions to Claude Through Slack and Agentforce 360" – trigger Agentforce actions from Claude, existing permissions and guardrails, MCP, RBC Wealth Management use case. (accessed 27 Aug 2026)
- Salesforce, "Headless Doesn't Mean Ungoverned: How Trust Works When Agents Call Salesforce", Miriam McCabe, 19 May 2026 – Headless 360, OAuth with PKCE under authenticated identity, object/FLS/sharing as guardrails, Agent Fabric, Event Monitoring and Shield, "design the audit trail before you need it". (accessed 27 Aug 2026)
- Anthropic, "Salesforce and Anthropic expanded partnership" – first LLM provider fully contained within the Salesforce trust boundary, traffic within Salesforce's VPC, regulated industries, Bedrock. (accessed 27 Aug 2026)
- Dreamforce 2026 – dates (15–17 September 2026) and expected next-generation Agentforce announcements, Moscone Center, San Francisco. (accessed 27 Aug 2026)
---
Robin Leonard is a Partner at Xenai Digital, an APAC enterprise Salesforce and AI consultancy. Two decades leading enterprise transformations across Australia, New Zealand, Singapore, Japan, and the broader Pacific. Splits his time between Auckland, Sydney and Tokyo, and rides a Royal Enfield Himalayan 450 when the weather agrees with him. linkedin.com/in/robinleonard1
