Claudeforce open beta readiness: the Salesforce agent permission and audit pre-flight · Enterprise Agentic AI Insights

Salesforce in Claude reaches open beta this month. Eight org settings to check first, including the two audit toggles that are off by default.

Somewhere in the next few weeks an admin in your org is going to see a new toggle, read the release note, and think this one is easy. It connects once. It uses the permissions we already have. There is no new model to design.

All three of those things are true, and that is exactly the problem.

Salesforce and Anthropic announced Claudeforce on August 26, 2026. Salesforce in Claude is with select pilot customers now, with open beta expected this month. VERIFIED S01 It ships as a plugin carrying thirty-seven prebuilt sales skills that let a seller reason over live revenue context, update pipeline, and take write action on CRM records without opening Salesforce at all. Claude inside Agentforce surfaces is already live.

For a CIO this is the good kind of problem. Sellers will actually use it, which is more than most agent rollouts can claim eighteen months in. The pilot will look great. The question is what you changed in the org before the flag went wide, because the answer determines whether the fourth month looks like the first.

What the plugin actually inherits

An admin connects Salesforce in Claude once. Authentication and permissions are centrally managed and the whole team gets access. Every answer and every action runs through the permissions and business rules already in the org. Object-level CRUD, field-level security and record sharing all continue to apply. Claude sees what the user is authorized to see and does what that user is authorized to do. CITED S02

Read that again as a security statement rather than a convenience statement.

Salesforce's own ecosystem guidance is blunt about the consequence: AI access does not fix an over-permissioned org, and where a seller already holds broad access to sensitive records or fields, the plugin can reach the same resources. The recommended pre-work is a review of profiles, permission sets, sharing rules, field-level security and access to sensitive operations before you enable AI-connected workflows. CITED S03

Here is the mechanic that people miss. Your permission model was not really designed. It accreted. Somebody widened a sharing rule in 2021 to unblock a quarter-end escalation. A permission set got cloned for a team that no longer exists. A field-level restriction never got applied to a custom object because the rep who requested it left. None of that mattered much, because a human being has to know a record exists, navigate to it, and read it. Practical obscurity was doing a lot of quiet security work for you.

An agent does not have practical obscurity. It reads the permitted surface in a single pass and summarizes it fluently. The gap between what a seller is technically permitted to see and what a seller has ever actually looked at is where your blast radius lives, and until this month nobody had a tool that could cross that gap in one query.

That is not a criticism of the product. The design decision to inherit the existing permission model rather than invent a parallel one is the right call, and the alternative would be worse. It just means the review you have been deferring is now on the critical path.

Salesforce agrees with you on this, which is worth knowing before you take it to your security team. The Architecture Center's agentic enterprise reference architecture, written explicitly for CIOs and CDOs, states that identity and access management has to move from static, role-based controls to dynamic, intent-based permissions granted just in time and revoked immediately after use, because of the new attack surface agents introduce. CITED S15 That is the target state in the vendor's own architecture guidance. A static role model inherited whole is the starting point, not the destination.

The evidence chain has two switches, and both are off

The second half is harder to see, because it fails silently.

The Einstein Trust Layer masks sensitive fields before they reach a model, retains no data by default, and logs interactions against a SOC 2 report scoped to Agentforce on Hyperforce. Good foundation. But in the Audit Trail tab, Log AI Interactions has to be switched ON for the prompt and response record to be created at all, and in-platform retention runs to roughly ninety days, configurable. Each call creates its own audit record. CITED S04

Separately, Agentforce Session Tracing is its own toggle, found under Setup, then Einstein Audit, Analytics and Monitoring Setup. And Agentforce Observability is not a core out-of-the-box capability. It depends on Data 360, formerly Data Cloud, to function at all. CITED S05

Salesforce does log MCP server activity through Event Monitoring, giving you user, activity and affected object. CITED S06 That is real and it is useful. It is also the kind of trail that security teams consistently find thin when an auditor asks not what happened but why the agent decided to do it.

Put the two halves together and you get the sentence that should be uncomfortable: for a period you cannot reconstruct after the fact, agents may have been reading and writing across a permission surface nobody had reviewed, with the log that would have shown it switched off.

Logging cannot be applied retroactively. Every call that happens before you flip that toggle is simply gone.

And here the gap between the architecture and the default is stark. The same Architecture Center document specifies that agent monitoring should log each step of an agent's run in an immutable audit trail, with continuous profiling to detect deviation from normal behavior, and it says plainly that because agents are non-deterministic, observability is what makes them auditable with human oversight at all. CITED S15 The reference architecture asks for an immutable trail. The default configuration ships with the log switched off and a ninety-day window. Closing that distance is your job, not the platform's, and it is a settings change rather than a program.

Read that figure left to right and the pre-flight writes itself. Every row on the right is a setting. Every row on the left is what somebody will eventually hold you to.

Why this stops being an IT problem

Now the part that moves it from a rollout question to a board question.

If you are in financial services, the control set you would normally inherit does not attach here. OCC Bulletin 2026-13, issued April 17, 2026 with the Federal Reserve Board and the FDIC, rescinded the 2011 interagency model risk framework and carries a scope exclusion for generative and agentic AI. VERIFIED S10 So when your Chief Risk Officer asks which framework governs an agent writing to customer records, the honest answer right now is that no supervisory framework claims it. That is not relief. It means the liability has no home, and unowned liability defaults to whoever is holding it when something goes wrong.

In Europe, reporting through early September describes the AI Office and national authorities beginning technical audits on Article 11 technical files for high-risk systems deployed after August 2. CITED S11 Worth being precise about the dates, because a lot of the commentary published since August has them wrong. What went live on August 2, 2026 is Article 50 transparency, with a transitional grace period to December 2, 2026 for systems already on the market. Annex III standalone high-risk moved to December 2027 and Annex I product-embedded high-risk to August 2028 under the Digital Omnibus, which took Council final approval on June 29, 2026. VERIFIED S11b

And in the United States, Massachusetts is moving what would be the strictest state-level frontier regime in the country, with enforcement vested in the attorney general. Anthropic supports it. OpenAI and Google oppose the current form and prefer a narrower audit-based approach. That split was still live as of September 7. CITED S12

Not one of those is satisfied by a ninety-day in-platform log that was switched off for the first month.

If your org touches China operations, the Implementation Opinions on Intelligent Agents from the Cyberspace Administration of China with the National Development and Reform Commission and the Ministry of Industry and Information Technology have been enforceable since July 15, 2026, with a three-tier decision-authority model and filing, testing and recall duties. VERIFIED S14 That is the only binding agent-specific regime anywhere in force today, and it does not care that your agent lives inside a CRM.

Where this sits in Salesforce's own architecture

If you want to take this to a security review without it sounding like one consultant's opinion, use the Architecture Center's own frame. It is the fastest way to get a room to agree on scope, because everybody in it can go read the source.

The reference architecture describes the traditional enterprise as five layers with two cross-layers spanning them. The agentic enterprise adds four more, for eleven total. CITED S15

Notice where the pre-flight actually lives. None of the eight settings sit in the Agentic Layer, which is the layer everyone is busy buying. They sit in the two cross-layers, Security and Governance, and IT Operations and Observability. Cross-layers are the ones that span everything and belong to nobody in particular, which is exactly why they get skipped in a rollout plan organised by product.

That is a useful thing to say out loud in a steering meeting. The reason your agent audit trail has no owner is not negligence. It is that the work is horizontal and your org chart is vertical.

The maturity model gives you the sentence to use with the board

Salesforce publishes a four-level Agentic Maturity Model alongside the architecture, and names the technology investments each level requires. CITED S15

Here is the part worth being precise about. Thirty-seven prebuilt skills taking governed write action on CRM records is Level 2 by the model's own definition. The model describes Level 2 as the shift from read-only retrieval to executing actions, and it lists what that shift requires: modular services with scoped permissions, application-side guardrails, agent monitoring, and a dedicated Agent Security Framework.

Most orgs turning the beta on this month hold Level 1 controls. RAG, a model gateway, some attribution in the UI, foundational observability if they were diligent.

So the sentence for your board or your risk committee is not "we are being careful with AI." It is: the beta moves us to Level 2 behaviour on Level 1 controls, and here is the two-week plan to close it. That is a sentence with a number, a named framework, a deadline and a cost. It tends to get funded.

Three more things on the Architecture Center worth an hour

The material is genuinely useful and most Salesforce teams have never opened it.

The MCP versus API decision guide. Salesforce in Claude reaches your org over MCP. There is a published guide on when MCP is the right connectivity choice against a conventional API, and it is the piece sitting directly underneath this rollout. CITED S16
The Agent Development Lifecycle. Agent development is treated as a lifecycle with a release process rather than a configuration exercise. This is the discipline missing from most of the deployments we see, and it pairs exactly with the Level 2 investment list.
The Reference Architecture Gallery. Downloadable diagrams in a notation Salesforce architects recognise on sight, including the Agentforce System Landscape and the Data 360 Customer Zero implementation architecture, which is Salesforce's own internal build. If you have to present this internally, draw it in their notation and skip the argument about the diagram.

One caution before you send your team looking. The trust and ethics content inside Trailhead sits in the Agentblazer Innovator trail, which is gated behind a prerequisite and framed as Solution Engineer enablement. It is good material in the wrong place for a CIO or a CRO. The architecture material is open, and it is the one to read.

The move: eight settings, done before the flag flips

This is a configuration exercise, not a program. A competent admin working with security can close most of it in a fortnight. The reason to do it now rather than after the pilot is the retroactivity problem: three of the eight cannot be backfilled.

Permission perimeter

Run a field-level security audit against every object the thirty-seven sales skills can touch. Not a sample. The plugin inherits the seller profile whole.
Narrow sharing rules on the objects that carry compensation, legal, health or pricing data that sellers can technically reach and in practice never open.
Define the write scope explicitly. Decide which objects an agent may update without a human confirmation, and require confirmation on everything else, starting with any outbound message to someone outside the company. The product supports this. Use it.

Evidence chain

Switch Log AI Interactions to ON before the beta flag, not after. This is the one that cannot be backfilled.
Export off-platform. Pipe Event Monitoring and Trust Layer output to your SIEM or an archive with a retention period your counsel has actually signed off on. Ninety days does not survive a regulatory cycle, an internal investigation, or a discovery request.
Enable Agentforce Session Tracing, so you hold the reasoning path and not only the outcome. Outcome logs answer what happened. Examiners ask why.

Ownership and spend

Put a name against agent action liability, in writing. Given the OCC scope exclusion, this will not be assigned to you by a regulator. Assign it yourself.
Set a monthly consumption ceiling and an alert. Flex Credits are consumed per action, standard actions run about twenty credits, and unused credits do not roll over between subscription terms. CITED S07 Agent volume grows quietly, and the first time most CIOs see the real number is in a renewal conversation they walked into without one.

Score your own org against those eight below. It takes about ninety seconds and nothing leaves your browser.

<div class="adx-preflight" role="region" aria-labelledby="adx-pf-title"> <style> .adx-preflight{--amber:#FF7900;--cyan:#07A3D1;--orange:#FF4F00;--ink:#0D0F12;--ink-deep:#07080A;--fg1:rgba(237,232,227,1);--fg2:rgba(237,232,227,.88);--fg3:rgba(237,232,227,.72);--ok:#1DAA64;--warn:#F5A623;font-family:Roboto,"Helvetica Neue",Arial,sans-serif;background:var(--ink);border:1px solid rgba(255,121,0,.28);border-radius:18px;padding:30px 26px 26px;margin:34px 0;color:var(--fg2);box-shadow:0 0 0 1px rgba(7,163,209,.14),0 26px 70px rgba(0,0,0,.62);position:relative;overflow:hidden} .adx-preflight *{box-sizing:border-box} .adx-preflight::before{content:"";position:absolute;inset:0 0 auto 0;height:3px;background:linear-gradient(135deg,#FF4F00 0%,#07A3D1 100%)} .adx-pf-eyebrow{font-size:14px;font-weight:600;letter-spacing:.14em;text-transform:uppercase;color:var(--cyan);margin:0 0 10px} .adx-preflight h3#adx-pf-title{font-family:Radley,Georgia,serif;font-size:29px;line-height:1.22;color:var(--fg1);margin:0 0 10px;font-weight:400} .adx-pf-sub{font-size:16px;line-height:1.6;font-weight:500;color:var(--fg2);margin:0 0 22px;max-width:62ch} .adx-pf-band{margin:0 0 20px;border-top:1px solid rgba(237,232,227,.14);padding-top:16px} .adx-pf-band>h4{font-size:14px;font-weight:600;letter-spacing:.1em;text-transform:uppercase;color:var(--amber);margin:0 0 4px} .adx-pf-bandnote{font-size:14px;font-weight:500;color:var(--fg3);margin:0 0 12px} .adx-pf-item{display:flex;align-items:flex-start;gap:13px;min-height:44px;padding:9px 12px;border-radius:11px;cursor:pointer;transition:background .16s ease;border:1px solid transparent} .adx-pf-item:hover{background:rgba(7,163,209,.09)} .adx-pf-item input{width:22px;height:22px;margin:3px 0 0;flex:0 0 22px;accent-color:var(--amber);cursor:pointer} .adx-pf-item input:focus-visible{outline:3px solid var(--cyan);outline-offset:3px} .adx-pf-item span{font-size:16px;line-height:1.55;font-weight:500;color:var(--fg2)} .adx-pf-item b{font-weight:600;color:var(--fg1)} .adx-pf-actions{display:flex;flex-wrap:wrap;gap:12px;margin:22px 0 0} .adx-pf-btn{font-family:inherit;font-size:16px;font-weight:600;min-height:44px;padding:12px 24px;border-radius:11px;border:0;cursor:pointer;background:linear-gradient(180deg,#FF8A1A 0%,#FF4F00 100%);color:#160B00} .adx-pf-btn.ghost{background:transparent;border:1px solid rgba(237,232,227,.32);color:var(--fg2)} .adx-pf-btn:focus-visible{outline:3px solid var(--cyan);outline-offset:3px} .adx-pf-out{margin:22px 0 0;padding:22px;border-radius:14px;background:var(--ink-deep);border:1px solid rgba(237,232,227,.16)} .adx-pf-out[hidden]{display:none} .adx-pf-score{display:flex;align-items:baseline;gap:12px;flex-wrap:wrap;margin:0 0 6px} .adx-pf-score strong{font-family:Radley,Georgia,serif;font-size:44px;line-height:1;color:var(--fg1);font-weight:400} .adx-pf-score em{font-style:normal;font-size:16px;font-weight:600;color:var(--fg3)} .adx-pf-badge{display:inline-block;font-size:14px;font-weight:600;letter-spacing:.08em;text-transform:uppercase;padding:6px 13px;border-radius:999px;margin:0 0 14px} .adx-pf-verdict{font-size:16px;line-height:1.62;font-weight:500;color:var(--fg2);margin:0 0 18px;max-width:64ch} .adx-pf-meter{height:12px;border-radius:999px;background:rgba(237,232,227,.14);overflow:hidden;margin:0 0 18px} .adx-pf-meter i{display:block;height:100%;border-radius:999px;background:linear-gradient(135deg,#FFB340 0%,#FF4F00 100%);width:0;transition:width .45s ease} .adx-pf-gaps{margin:0;padding:0;list-style:none} .adx-pf-gaps li{font-size:16px;line-height:1.58;font-weight:500;color:var(--fg2);padding:11px 0 11px 17px;border-left:3px solid var(--orange);margin:0 0 10px;background:rgba(255,79,0,.07);border-radius:0 9px 9px 0;padding-right:14px} .adx-pf-gaps li b{display:block;font-weight:600;color:var(--fg1);margin:0 0 3px} .adx-pf-gaps li.clear{border-left-color:var(--ok);background:rgba(29,170,100,.09)} .adx-pf-foot{font-size:14px;line-height:1.6;font-weight:500;color:var(--fg3);margin:18px 0 0;padding-top:16px;border-top:1px solid rgba(237,232,227,.14)} .adx-pf-foot a{color:var(--cyan);font-weight:600} @media (max-width:560px){.adx-preflight{padding:24px 18px}.adx-preflight h3#adx-pf-title{font-size:25px}} @media (prefers-reduced-motion:reduce){.adx-pf-meter i,.adx-pf-item{transition:none}} </style>

<p class="adx-pf-eyebrow">Interactive · AEGIS Diagnostic preview</p> <h3 id="adx-pf-title">Claudeforce pre-flight: the eight settings</h3> <p class="adx-pf-sub">Check every item that is already true in your production org. Not what is on the roadmap, what is switched on today. Eight questions, about ninety seconds.</p>

<form id="adx-pf-form"> <fieldset class="adx-pf-band" style="border:0;padding:0;margin:0 0 20px;border-top:1px solid rgba(237,232,227,.14);padding-top:16px"> <legend style="padding:0"><h4 style="margin:0 0 4px">Band 1 · Permission perimeter</h4></legend> <p class="adx-pf-bandnote">What the agent can reach is what the seller can reach. Nothing narrows it for you.</p> <label class="adx-pf-item"><input type="checkbox" data-w="3" data-gap="Run a field-level security audit on every object the 37 sales skills touch. The plugin inherits the seller profile whole. A field a rep never scrolls to is still a field the agent can read and summarize." data-fix="Field-level security reviewed for agent reach"><span><b>Field-level security reviewed</b> against every object the sales skills touch, in the last 90 days.</span></label> <label class="adx-pf-item"><input type="checkbox" data-w="3" data-gap="Cut standing access on the sensitive objects. Broad sharing rules were tolerable when a human had to click through record by record. An agent reads the permitted surface in one pass." data-fix="Sharing rules narrowed on sensitive objects"><span><b>Sharing rules narrowed</b> on compensation, legal, health or pricing objects that sellers can technically see.</span></label> <label class="adx-pf-item"><input type="checkbox" data-w="2" data-gap="Name the write scope explicitly. Decide which objects an agent may update without a human confirmation step, and configure the confirmation on everything else, starting with any outbound message to a party outside the company." data-fix="Write scope and confirmation steps defined"><span><b>Write scope defined</b>, with confirmation required before any outbound external message.</span></label> </fieldset>

<fieldset class="adx-pf-band" style="border:0;padding:0;margin:0 0 20px;border-top:1px solid rgba(237,232,227,.14);padding-top:16px"> <legend style="padding:0"><h4 style="margin:0 0 4px">Band 2 · Evidence chain</h4></legend> <p class="adx-pf-bandnote">The logs that prove what an agent did are opt-in, and they do not hold for long.</p> <label class="adx-pf-item"><input type="checkbox" data-w="3" data-gap="Switch Log AI Interactions to ON in the Einstein Trust Layer Audit Trail tab. It is off by default. Until it is on, the prompt and response record for every agent call does not exist, and it cannot be created after the fact." data-fix="Trust Layer AI interaction logging enabled"><span><b>Log AI Interactions is ON</b> in the Einstein Trust Layer Audit Trail tab.</span></label> <label class="adx-pf-item"><input type="checkbox" data-w="3" data-gap="Export the evidence off-platform. In-platform retention runs to roughly 90 days. Every regulatory and audit cycle that matters runs longer than a quarter. Pipe Event Monitoring and Trust Layer output to your SIEM or archive with a retention period your counsel signed off on." data-fix="Agent logs exported beyond the 90-day window"><span><b>Logs export off-platform</b> to a SIEM or archive, past the roughly 90-day in-platform window.</span></label> <label class="adx-pf-item"><input type="checkbox" data-w="2" data-gap="Turn on Agentforce Session Tracing under Setup, Einstein Audit, Analytics and Monitoring Setup. Without it you can see that an action happened but not the reasoning path that produced it, which is the part an examiner asks about." data-fix="Session tracing enabled"><span><b>Agentforce Session Tracing is ON</b>, so you hold the reasoning path and not only the outcome.</span></label> </fieldset>

<fieldset class="adx-pf-band" style="border:0;padding:0;margin:0 0 20px;border-top:1px solid rgba(237,232,227,.14);padding-top:16px"> <legend style="padding:0"><h4 style="margin:0 0 4px">Band 3 · Ownership and spend</h4></legend> <p class="adx-pf-bandnote">A consumption line with no ceiling and no named owner is a board question waiting to be asked.</p> <label class="adx-pf-item"><input type="checkbox" data-w="2" data-gap="Put a name against agent action liability. Federal model risk guidance revised in April 2026 carries a scope exclusion for generative and agentic AI, so the control set your model risk function would normally inherit does not attach here. Somebody owns it anyway. Decide who before an incident decides for you." data-fix="Named owner for agent action liability"><span><b>A named executive owns</b> agent action liability, in writing, not by assumption.</span></label> <label class="adx-pf-item"><input type="checkbox" data-w="2" data-gap="Set a consumption ceiling and an alert. Flex Credits are consumed per action and unused credits do not roll over into the next term. Agent volume that grows quietly becomes a renewal conversation you walk into without numbers." data-fix="Consumption ceiling and alerting in place"><span><b>A monthly consumption ceiling</b> and an alert threshold exist for agent credit burn.</span></label> </fieldset>

<div class="adx-pf-actions"> <button type="button" class="adx-pf-btn" id="adx-pf-go">Score my org</button> <button type="button" class="adx-pf-btn ghost" id="adx-pf-reset">Reset</button> </div> </form>

<div class="adx-pf-out" id="adx-pf-out" hidden role="status" aria-live="polite" tabindex="-1"> <div class="adx-pf-score"><strong id="adx-pf-num">0</strong><em id="adx-pf-den">of 20 readiness points</em></div> <div class="adx-pf-meter"><i id="adx-pf-bar"></i></div> <p class="adx-pf-badge" id="adx-pf-badge"> </p> <p class="adx-pf-verdict" id="adx-pf-verdict"></p> <ul class="adx-pf-gaps" id="adx-pf-gaps"></ul> <p class="adx-pf-foot">Scored against the AEGIS framework, the Agentic Enterprise Governance and Intelligence Standard. Nothing is sent anywhere, this runs entirely in your browser. If two or more bands come back short, that is a scoping conversation rather than a settings change. <a href="https://ariana.digital/ai-success-pack.html">Book a 30-minute AI Success consult</a>.</p> </div>

What good looks like in ninety days

The teams that get this right are not the ones that move slowest. They are the ones that turn the beta on for a named pilot group with the logging already running, and re-score after four weeks of real traffic rather than four weeks of demo traffic.

Then they do the thing almost nobody does, which is to go back and look at what the agent actually reached. Not what it was permitted to reach. What it touched. That list is the most honest description of your data estate you will ever get, and it is free.

Adoption is not the constraint on agentic AI in the enterprise anymore. Reconstruction is. The organizations that will move fastest in 2027 are the ones that can explain, on demand and with evidence, what their agents did and why. Everyone else will be running a controlled slowdown while they rebuild a trail they could have captured for the cost of one toggle.

The flag is coming this month. The eight settings take a fortnight. That math still works, but not for much longer.

---

Working through this in your own org? Ariana Digital runs the AEGIS Diagnostic, a scoped two-week engagement that maps agent permission perimeter and evidence chain across Salesforce, Microsoft and ServiceNow environments, and hands back a prioritized remediation plan your admin team can execute. Principal led, domain-savvy AI-ready teams, no handoff to a bench. Book a 30-minute AI Success consult or read the AI governance framework.

AEGIS is the Agentic Enterprise Governance and Intelligence Standard, the framework Ariana Digital uses to structure agent oversight, evidence and accountability in regulated environments.

---

Sources

S01 Salesforce, "Salesforce and Anthropic Announce Claudeforce: The #1 AI Meets the #1 AI CRM," August 26, 2026. https://www.salesforce.com/news/press-releases/2026/08/26/salesforce-and-anthropic-announce-claudeforce/ and https://www.salesforce.com/claudeforce/

S02 Apex Hours, "Claudeforce Explained: What Salesforce and Anthropic Actually Ship." https://www.apexhours.com/claudeforce-explained-what-salesforce-anthropic-actually-ship/

S03 Cirrius Solutions, "Claudeforce Is New. Running Salesforce Through Claude Is Not." https://cirriussolutions.com/claudeforce-readiness/

S04 Salesforce Dictionary, "Salesforce Einstein Trust Layer: Complete 2026 Guide." https://salesforcedictionary.com/blogs/salesforce-einstein-trust-layer-complete-2026-guide

S05 Salesforce Break, "Exploring and Setting Up Agentforce Observability," May 28, 2026. https://salesforcebreak.com/2026/05/28/setting-up-agentforce-observability/

S06 Strac, "Salesforce MCP Server: Secure Setup for Claude and AI Agents (2026)." https://www.strac.io/blog/salesforce-mcp-server and "How to Monitor AI Agents: Audit Logging, SIEM and Observability (2026)." https://www.strac.io/blog/monitor-ai-agents

S07 Constellation Research, "Salesforce revamps Agentforce pricing with Flex Credits." https://www.constellationr.com/insights/news/salesforce-revamps-agentforce-pricing-flex-credits-what-you-need-know

S10 Office of the Comptroller of the Currency, Bulletin 2026-13, "Model Risk Management: Revised Guidance," April 17, 2026. https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html

S11 Cubbbix, "AI Regulation News September 2026: Global Update and Deadlines." https://cubbbix.com/blog/ai-regulation-september-2026-global-update

S11b European Commission, AI Act regulatory framework. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai and Gibson Dunn, "EU AI Act Omnibus Agreement Postpones High-Risk Deadlines and Other Key Changes," May 27, 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

S12 Boston Globe, "Anthropic backs new AI regulations in Massachusetts that would be among strictest in nation," June 26, 2026. https://www.bostonglobe.com/2026/06/26/business/anthropic-massachusetts-ai-regulations-bill/ and PYMNTS, "Anthropic and OpenAI Split as Massachusetts Pushes Nation's Toughest AI Safety Rules." https://www.pymnts.com/news/artificial-intelligence/2026/anthropic-and-openai-split-as-massachusetts-pushes-nations-toughest-ai-safety-rules/

S16 Salesforce, "Architecting Secure Agent Connectivity: A Guide to Choosing Between MCP and APIs." https://www.salesforce.com/blog/architecting-secure-agent-connectivity-mcp-apis/ and "Scale Agent Development with Salesforce Headless 360, the Agent Development Lifecycle." https://www.salesforce.com/blog/agent-development-lifecycle-headless/

S15 Salesforce Architecture Center, "The Agentic Enterprise: The IT Architecture for the AI-Powered Future," reviewed September 8, 2026. Eleven-layer reference architecture and four-level Agentic Maturity Model for CIOs and CDOs. https://architect.salesforce.com/fundamentals/agentic-enterprise-it-architecture and the Reference Architecture Gallery at https://architect.salesforce.com/diagrams

S14 Cyberspace Administration of China, National Development and Reform Commission and Ministry of Industry and Information Technology, Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents, enforceable July 15, 2026. https://www.cac.gov.cn/

---

Method and correction policy

Every edition is researched fresh against sources published within the preceding seven days where the item is time-sensitive. Figures carry a chip: VERIFIED means named, dated and publicly checkable; CITED means named source, not independently re-verified; FLAG means contested and pending re-verification. Where market commentary conflicted with primary legal sources this week, notably on EU high-risk applicability, we followed the primary legal sources and said so.

Open the formatted article on Ariana.Digital →