The 'One Setting' Is Actually a Critical Area: Connected Apps
While there isn't a single 'AI on/off switch' for security, the closest and most crucial area to scrutinize is the permissions you've granted to 'Connected Apps'. These are the third-party applications—from marketing automation platforms to new generative
AI assistants—that integrate with Salesforce via its APIs. Each connected app is granted specific permissions, or OAuth scopes, that define what it can see and do within your org. For years, managing these might have felt like routine IT housekeeping. In the age of AI, it has become a strategic imperative. An app with overly broad permissions, such as 'Full access (full)' or 'Manage user data via APIs (api)', creates an open door that sophisticated AI tools can exploit at a scale and speed previously unimaginable.
Why AI Dramatically Magnifies the Risk
Traditional apps often performed predictable, limited tasks. AI is different. An AI agent connected to Salesforce can be prompted to analyze, summarize, or act upon vast quantities of data in seconds. If its underlying connected app has excessive permissions, the risks multiply exponentially. An agent could inadvertently expose sensitive customer data in its responses, act on incorrect or 'hallucinated' information by reading the wrong fields, or be used to exfiltrate massive datasets far faster than a human could. Experts note that the primary danger is the combination of automation and broad access. A poorly governed AI agent with the wrong permissions could unintentionally modify thousands of records, trigger costly automation loops, or rack up enormous API call volumes, leading to direct financial consequences.
Your Quick Audit Checklist: Applying the Principle of Least Privilege
Securing your Salesforce instance against these new threats starts with a deliberate audit of your connected apps, guided by the 'principle of least privilege'—granting only the minimum access required for a task. First, navigate to 'App Manager' in Setup and review every single connected app. Ask critical questions for each: Is this app still in use? Who owns it? Does a reporting tool really need permission to modify or delete records? Second, create dedicated integration users for your apps instead of linking them to a system administrator's profile. This isolates the app's permissions and prevents a single compromised account from giving away the keys to the kingdom. Finally, for apps that are absolutely necessary, ensure their OAuth scopes are as restrictive as possible. If an app only needs to read contact information, it should not have permission to access anything else. This granular control is your best defense against both accidental misuse and malicious attacks.
Looking Inward: Understanding Salesforce's Own AI Safeguards
While you are responsible for third-party apps, it's also important to understand how Salesforce protects data with its own native AI. The core of this is the Einstein Trust Layer, a security architecture built into features like Einstein Copilot. This layer acts as a secure go-between, intercepting prompts before they reach a large language model (LLM). It automatically masks sensitive data like names and credit card numbers, performs secure data retrieval to ground the AI's answer in relevant CRM data, and enforces a zero-retention policy, meaning your data is not stored or used to train the general LLM. Knowing this helps you differentiate between the built-in trust of native Salesforce AI and the variable, user-managed trust of external connected apps.
