What it is
Capability-based authorization grants an agent the right to perform specific, named actions — each a revocable 'capability' checked at the moment of use — instead of a blanket credential that can do anything the underlying account can. Every action passes through a gate, often expressed as a can() check, that asks whether this agent is permitted to do this exact thing to this exact resource right now. The idea traces back to capability-based security in operating systems (Dennis and Van Horn, MIT, 1966) and the principle of least privilege from Saltzer and Schroeder (1975); it is now the safest way to authorize software that can act on its own.
Why it matters
Agents act, and an agent that inherits a human's full permissions or a wildcard API key can do real damage from one bad instruction or a prompt injection. Least privilege has been settled security doctrine since Saltzer and Schroeder formalized it in 1975, but AI agents make it urgent because they take actions at machine speed without a person reviewing each one. For a Salesforce business this maps directly onto tools you already have: an agent should be scoped to read a handful of fields and update one object, mirroring Field-Level Security and permission sets, not granted the running user's entire profile. Scoped, revocable capabilities mean a compromised or confused agent can only ever do the small set of things you explicitly allowed.
Key capabilities
- Permissions are granted per action and resource, not as one broad credential
- Every action is checked at call time through a gate, commonly a can() function
- Capabilities are revocable instantly without rotating shared secrets or breaking other agents
- Scopes are narrow by default, following least privilege, so the blast radius stays small
- The agent gets its own identity and permissions rather than borrowing a human's full access
- Grants are auditable, so you can see exactly what each agent was allowed to do and when
How it works
- Define discrete capabilities, such as 'read Contact.Email' or 'update Case.Status'
- Assign each agent only the capabilities its job requires, and nothing more
- Route every attempted action through a gate that checks the agent's capabilities at call time
- Allow the action only if a matching capability exists; otherwise deny and log it
- Revoke or narrow a capability the moment an agent's role changes or something looks wrong
- Keep an audit trail of grants and denials for governance and review
Examples
“Instead of giving a support agent your full Salesforce admin credentials, you grant it three capabilities: read Case, read Contact.Email, and update Case.Status. It can triage and update cases, but it cannot touch opportunities, delete records, or read fields outside its scope.”
How it connects
In Agentforce, this maps directly to how you configure agent actions and Topics — you grant each agent only the specific flows, objects, and fields it needs, using Salesforce permission sets and named credentials rather than a shared admin account.
Good to know
A common mistake is giving an agent a service account with an administrator-grade API key 'to keep things simple.' That collapses least privilege entirely — the agent can now do anything the account can, and a single prompt injection turns that reach into a liability. Scoping capabilities up front is far cheaper than containing an over-privileged agent after the fact.
Frequently asked questions
What is capability-based authorization for AI agents?
Capability-based authorization grants an AI agent narrow, revocable permissions for specific actions, each checked at the moment it is used, instead of a broad API key or a human's full access. Every action passes through a gate that asks whether this agent may perform this exact action on this exact resource. It keeps an agent's reach limited to only what you explicitly allowed.
Why do AI agents need their own scoped permissions?
Because agents take actions autonomously and at machine speed, so any permission they hold can be triggered without a person reviewing it. If an agent inherits a human's full access or a wildcard key, one bad instruction or prompt injection can cause real damage. Scoped, revocable capabilities ensure a compromised agent can only do the small set of things it was granted.
How does capability-based authorization relate to least privilege?
It is the practical mechanism for enforcing least privilege, the principle from Saltzer and Schroeder's 1975 work that every component should have only the access its job requires. Capability-based authorization gives each agent the minimum set of named actions it needs and nothing more. Least privilege is the goal; scoped capabilities are how you implement it for agents.
How does this apply in Salesforce?
In Salesforce it maps onto tools you already use, like Field-Level Security and permission sets. Rather than running an agent as a user with a full profile, you scope it to read specific fields and update a single object. That way the agent mirrors the least-privilege access a well-configured human user would have, and no more.
Related terms
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
Capability Registry
A structured catalog that maps AI capabilities (reasoning, structured output, tool use, vision, long context) to the models that can serve them — the substrate that makes skills portable across LLM vendors.
Field-Level Security (FLS)
Salesforce's per-field read and edit permission control — the mechanism that keeps an Agentforce agent from seeing or changing fields it shouldn't.
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
Human-in-the-Loop (HITL)
A design pattern where AI systems require human approval or intervention at critical decision points before taking action.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.