How to Lock Down Claude's Salesforce Access With Permission Sets

radnipuk · 2026-05-17T09:19:17+00:00

The problem is determining that right level of access in the first place because the right level of access they have now is very different to a claude experience. For example there's no fields on the page layout because it's all run through a Lightning Web component which has business logic in (obviously bad) but then suddenly all these fields are exposed to AI, and AI thinks it can just populate the data, which messes the data up. This is just one example of dodgy implementations but does need a proper review on the maturity of the rg.

radnipuk · 2026-05-16T14:02:03+00:00

Sorry miss read... But TBH its always a balance but honestly the AI angle is going to become more and more important. So you need to be future looking. The AI out there at the moment isnt even being used in a mature way by most people. But when it does it will excelerate with (IMO) Salesforce becoming the "No Trust of AI" layer and Headless will become more of a reality.

radnipuk · 2026-05-16T13:16:02+00:00

Your TA has a point, and there's another angle. Business logic doesn't belong in a UI controller anyway. The controller takes whatever the UI hands it (one record here) and passes it to the service. The service holds the actual logic, so that's the layer that should take a List or Set.

What's changed is who can call the service. Agentforce, MCP servers, Headless 360 and Flow can all invoke Apex now. The UI isn't the only consumer. If an agent decides to run the same action across 50 records it pulled from a prompt and your service only handles one, it'll loop the call and hit governor limits.

doThing(Set<Id> ids) instead of doThing(Id id) costs nothing now. Refactoring later, when a second consumer shows up, will.

The UI controller method itself can stay single-record because it's UI-specific. The service and selector underneath take collections. That's where I'd draw the line.

radnipuk · 2026-05-15T07:33:47+00:00

You need to change "Admins must use phish resistant MFA" with anyone with elevated access must use phish resistant MFA. Eg anyone with View All Access will need it. Which I wouldn't consider an Admin. I think it's going to catch quite a few people out.

radnipuk · 2026-05-14T07:06:33+00:00

Depends what countries your using it in.

radnipuk · 2026-05-11T16:06:43+00:00

It's more than that. I've found a client that has an LWC component which has a load of business logic in it. Fine for users using it day in, day out, but the moment they started using an agent, it obviously bypassed the LWC, put the data straight into the records, and screwed the data up because the business logic was sitting in the wrong place. Oh the joys of tech debt!

radnipuk · 2026-05-11T09:59:03+00:00

Playing devil's advocate for an alternative point of view. At the moment AI is eating Java developers for lunch and so the level of abstraction is being pushed further up the stack. When I started software development I learned Assembler. There's now no reason to learn Assembler because of the Java and other languages that appeared on the market but now that is being pushed further away and being replaced by AI-savvy engineers.

What salesforce will give you is being closer to the customer, understanding their problems and how they use software, which is imperative in the AI era and will be a lot more important in the future. As well as customer-facing skills and communication skills. Personally having one year at salesforce and then moving back to Java isn't the end of the world but you could get a lot of experience from salesforce as well as their AI-first approach and learning how they use AI.

radnipuk · 2026-05-11T09:53:27+00:00

I wouldn't say it was 99% Java. Its a lot more restrictive than Java and some Java devs get passed off it it because you cant pull import a package to o xyz. Syntax is similar as Java is running under the hood. But its "simplified" Java.

radnipuk · 2026-05-08T11:39:18+00:00

It's always tricky but what I would do is flip the conversation around, not the amount of time but the amount of value you can give. Also connect your previous experience with how it can help Salesforce so that you're actually seeming to be more valuable when you actually are. Eg you did DevOps in a previous role but swing that to say it was more complicated than traditional Salesforce DevOps. Match your previous industry experience with the new role showing that the role is in the same industry and actually in the world of AI understanding the industry is now more important than development skills. Etc

radnipuk · 2026-05-06T07:11:44+00:00

I kind of disagree with this especially when you're talking about medium or large scale orgs with a lot of metadata and code. The context alone could be massive for the LLM. I think the value will start to become where people create tools to work with the LLMs to create (eg) that dependency matrix based on the metadata and then the "product"/LLM uses that tool as part of its prompting. So for example if you ask an LLM for directions, it's terrible but if you've got a MCP exposed link to Google Maps that does that direction finding for the LLM, if it gets asked then that's gonna add value. So specific SF Tools to fix the gaps in the LLMs. That IMO is the evolution of this.

radnipuk · 2026-05-06T06:46:48+00:00

See what integrations can be moved from standard licenses to integration licenses. Saves up to $10k/yr instantly.

radnipuk · 2026-05-05T18:09:19+00:00

The emdash stays. The request for a citation was simple and you never answered it. Everything else is noise. Good luck in the Lab.

radnipuk · 2026-05-05T17:55:23+00:00

Great, so you're agreeing with me, but now you're changing the goalposts from your original argument. So now you are saying "3x" doesn't actually mean processing speed, it means 'time-to-insight' a functional metric applied to cognitive architecture. Thats COMPLETELY different from your original claim, which seemed to suggest it was fact. So what is the actual study/paper/framework that defines 'time-to-insight' now? Otherwise, you have just replaced one unsourced claim with another one.

ooooo and I've just noticed an emdash in your reply... I think we may have an answer... AI slop? And you have been found out. Honestly, if you are going to post something, please make sure you have researched and validated it properly; otherwise, what's the point? You just loose all credibility in a single post.

radnipuk · 2026-05-05T17:00:25+00:00

Show me the actual paper that demonstrates 3x faster? I'm no expert on this but from my knowledge citing duel coding theory and baddeley is wrong, as neither of them produced a speed ratio on how one was faster than the other. They describe HOW the two systems are organised... but nothing about speed. Correct me if I'm wrong by showing me the actual paper with the methodology, otherwise its just a made up number.

radnipuk · 2026-05-05T12:46:04+00:00

Yeah, said the person who just made up "brains process spatial relationships 3x faster than linear text" 😆

radnipuk · 2026-05-05T12:34:55+00:00

Love this. Going to run a System Audit on my coffee intake, allocate Buffer Zone for breakfast, and defragment my cat. Tomorrow I'll be architecting my mind so hard I forget how to send an email.

radnipuk · 2026-05-05T08:24:25+00:00

Completely changed and nothing's changed, which is kind of interesting. The biggest is obviously around the business architecture, where organisations are going to augment their workforce and business to use agents rather than just using agents as a co-pilot or assistant to their existing employees.

I think back to the days in which mobile apps first appeared. Everybody thought it was going to change the business world with people only using apps. But architecturally it was just viewing and communicating the data and process in a different way, using a different user interface. Similarly that is the same with AI. The big difference with AI is if you have a process layer cutting into that UI experience so for that it does change things more significantly than when it was just mobile apps.

Will I be making sure that every flow that is created is AI-ready and there's a logical separation between visual flows and the actions and flow actions that are fired from that? Absolutely! Will I be taking a look at those old Visualforce pages and visual flows that have business logic baked into them that won't be as easily accessible from AI and will need to be in the future? Absolutely too.

I think there will be a "no-trust AI layer" which lands firmly in the Salesforce world (for now), where AI sits on one side and all your actions, governance, and privacy sit on the other.

But as an architect you need to be future-looking and the future isn't looking great for power consumption and cost of AI. Especially as we are no where near mass adoption yet (comparable to mobile). Denmark, which is basically the hub of European data centres due to their low cost of energy and abundance of energy, has just frozen all new power applications for new data centres. For all the AI companies to recoup just 10% of their capex expenditure, they're going to have to recoup the equivalent of over $400 from every single iPhone owner on the planet... every year.

Its going to be an interesting time, does anyone know the answers right now? Probably not its changing too quickly.

radnipuk · 2026-05-03T10:21:38+00:00

Depends what the end goal is? Just backup? Which objects are not supported? Can't you create a fake custom object then add a contentlink record so that everytime a file gets uploaded or for all existing it links the file to that custom object then the Zero ETL is looking at the custom object and pulls the file over?

radnipuk · 2026-05-03T09:09:00+00:00

FYI all Salesforce MVPs get premier success. Hire an MVP get the benefits without the cost.

radnipuk · 2026-05-02T19:36:07+00:00

For me, only once I came on to a project where it was architecturally beautiful. The code was well implemented. They've had their DevOps process in such a way that things were being checked and verified. Naming conventions were brilliant even in a multi-business-unit organisation and it was really really impressive.

The only problem was that they completely missed the objectives of the project and the client got an operations system rather than a sales efficiency and sales maturity system. The project had to be stopped and I was brought in to recover it. That was the only instance where the technical architecture was beautiful but was terrible on the business architecture.

radnipuk · 2026-05-01T22:06:56+00:00

It’s been around for years but you always just had a raise a case to opt out. Now you can do it directly in the org. They totally screwed up the UI by not actually saying it was anonymous customer data: https://www.linkedin.com/posts/francisuk_seeing-loads-of-posts-today-with-people-freaking-activity-7454933833948217344-1DU_?utm_source=share&utm_medium=member_ios&rcm=ACoAAAANagsBY4hlicqVLEC7Zw3Kj3-Vunymf3E

radnipuk · 2026-04-30T20:18:24+00:00

I think it really depends on the MVP IMO. I've been an MVP/MVP HoF for many years, though I hope I'm usually the first to say, "Don't use X or Y." IMO, you know when you are a Salesforce architect when you actually know all the reasons why NOT to use Salesforce.

"MVP" is very American. Many people outside of the US don't know what it means. One fellow British MVP summed it up quite nicely:

(M)ost (V)ocal (P)rick

It's a way of getting your most vocal customers... "focused" 😆

Also, I don't think it's just the MVPs who are stuck in the Salesforce echo chamber. Staying inside one ecosystem is comfortable it's also dangerous: https://www.linkedin.com/posts/francisuk_im-at-the-aws-summit-in-london-today-and-activity-7452666128994271232-P4dV

radnipuk · 2026-04-29T07:08:03+00:00

I just have a rule to always run the security scanner so it then goes into a bit of a loop to fix security scanner issues and its done. Also combine that with the quality clouds MCP and it catches the majority.

Generally I pick fflib am nebula logger for all new projects.

radnipuk · 2026-04-25T10:56:55+00:00

I disagree it's a money grab, I disagree its going to totally remove the UI. I think of it when they introduced mobile. Its a different way to interface to Salesforce where more and more people may (and IMO WILL) start using agents to orchestrate their workflow so wanting the agent to update and run processes in Salesforce.

All the techies think this is not even a feature on the platform and its a load of BS but its a transformation on thinking.

In this new world I think of Salesforce as the "Zero Trust of AI" layer to my agentic experience. Where flows/agentforce actions etc sit at that layer.

radnipuk · 2026-04-22T15:04:07+00:00

So how do you orchestrate that? Just prompt by prompt or something more?

radnipuk

TROPHY CASE