What it is
Capability-based authorization grants an agent the right to perform specific, named actions — each a revocable 'capability' checked at the moment of use — instead of a blanket credential that can do anything the underlying account can. Every action passes through a gate, often expressed as a can() check, that asks whether this agent is permitted to do this exact thing to this exact resource right now. The idea traces back to capability-based security in operating systems (Dennis and Van Horn, MIT, 1966) and the principle of least privilege from Saltzer and Schroeder (1975); it is now the safest way to authorize software that can act on its own.
Why it matters
Agents act, and an agent that inherits a human's full permissions or a wildcard API key can do real damage from one bad instruction or a prompt injection. Least privilege has been settled security doctrine since Saltzer and Schroeder formalized it in 1975, but AI agents make it urgent because they take actions at machine speed without a person reviewing each one. For a Salesforce business this maps directly onto tools you already have: an agent should be scoped to read a handful of fields and update one object, mirroring Field-Level Security and permission sets, not granted the running user's entire profile. Scoped, revocable capabilities mean a compromised or confused agent can only ever do the small set of things you explicitly allowed.
Key capabilities
- Permissions are granted per action and resource, not as one broad credential
- Every action is checked at call time through a gate, commonly a can() function
- Capabilities are revocable instantly without rotating shared secrets or breaking other agents
- Scopes are narrow by default, following least privilege, so the blast radius stays small
- The agent gets its own identity and permissions rather than borrowing a human's full access
- Grants are auditable, so you can see exactly what each agent was allowed to do and when
How it works
- Define discrete capabilities, such as 'read Contact.Email' or 'update Case.Status'
- Assign each agent only the capabilities its job requires, and nothing more
- Route every attempted action through a gate that checks the agent's capabilities at call time
- Allow the action only if a matching capability exists; otherwise deny and log it
- Revoke or narrow a capability the moment an agent's role changes or something looks wrong
- Keep an audit trail of grants and denials for governance and review
Examples
“Instead of giving a support agent your full Salesforce admin credentials, you grant it three capabilities: read Case, read Contact.Email, and update Case.Status. It can triage and update cases, but it cannot touch opportunities, delete records, or read fields outside its scope.”
How it connects
In Agentforce, this maps directly to how you configure agent actions and Topics — you grant each agent only the specific flows, objects, and fields it needs, using Salesforce permission sets and named credentials rather than a shared admin account.
Good to know
A common mistake is giving an agent a service account with an administrator-grade API key 'to keep things simple.' That collapses least privilege entirely — the agent can now do anything the account can, and a single prompt injection turns that reach into a liability. Scoping capabilities up front is far cheaper than containing an over-privileged agent after the fact.
Related terms
Human-in-the-Loop (HITL)
A design pattern where AI systems require human approval or intervention at critical decision points before taking action.
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
Capability Registry
A structured catalog that maps AI capabilities (reasoning, structured output, tool use, vision, long context) to the models that can serve them — the substrate that makes skills portable across LLM vendors.
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
Field-Level Security (FLS)
Salesforce's per-field read and edit permission control — the mechanism that keeps an Agentforce agent from seeing or changing fields it shouldn't.