What it is
Threat modeling is the discipline of systematically asking "how could this be attacked or misused?" before you ship. For traditional software that means thinking about input validation, authentication, and data exposure. For AI agents it expands to cover the agent's memory, the tools it can call, the prompts that steer it, the humans who approve its actions, and the trust boundaries between agents. Frameworks like STRIDE provide a starting checklist; AI-specific frameworks (OWASP LLM Top 10, MITRE ATLAS) extend it to cover prompt injection, data poisoning, and other model-specific threats.
Why it matters
Agents act in the world — they send emails, update CRM records, charge cards, post to social. A vulnerability in a deterministic web app might leak data; a vulnerability in an agent might book the wrong meeting, refund the wrong customer, or post the wrong message under your brand. Threat modeling early — before an agent is wired into production systems — catches design flaws that guardrails alone cannot patch later. For Salesforce customers deploying Agentforce, it is also a practical way to answer the questions security and compliance reviewers ask about an agent.
Key components
- Assets — what the agent can access, change, or speak for
- Trust boundaries — where data moves from less-trusted to more-trusted contexts
- Threat actors — who would benefit from misusing the agent
- Attack surfaces — prompts, tools, memory, connected data sources
- Mitigations — guardrails, human-in-the-loop checkpoints, scoped permissions, observability
How it connects
In Agentforce, threat modeling maps directly to decisions you make in Agent Builder — which topics an agent can act on, which Flows and Apex actions it can trigger, and how much it can do without a human approving the step. Getting those boundaries wrong at design time is far cheaper to fix than after the agent is live in your org.
Good to know
You don't need a security team to start — a one-page table listing each action your agent can take, who could trigger it maliciously, and what the worst outcome would be is enough to surface the highest-risk design choices before you go live.
Related terms
AI Agent
An autonomous AI system that can perceive its environment, make decisions, and take actions to achieve specific goals - without constant human direction.
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
Trust Layer
Salesforce's AI trust and safety framework that ensures agents operate within compliance boundaries, prevent misuse, and maintain data security.
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
Data Poisoning
Manipulating the data an AI model learns from — training sets, fine-tuning examples, or knowledge-base documents — so the resulting model is biased, broken, or contains hidden behaviors.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
STRIDE
A six-category threat-modeling framework — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege — adapted from classic software security to AI agents.
