In Salesforce, people assume that if an Agentforce agent "runs as a user," it also cannot see data that user cannot see. The Apex, Flow and prompt path behind the agent can quietly pass the running user's field-level security and sharing boundary — and nothing in Setup shows the difference.
So I measured it. Same source, same org, same user; only the API version differs:
| API version | records returned |
|---|---|
| v58 | 5 |
| v67 | 0 |
That gap needed a reproducible number, and the number needed a definition someone who did not produce it could check.
Aksu Index: 6 proven (1 regulated) · 0 unproven boundaries · 1 unresolved
AKSU:1.0/P:6/C:1/B:0/U:1/fp:da237145496c
Four numbers, never fewer: quoting proven alone while unresolved is above zero is defined as a violation, because a silent "clean" is worse than an honest unknown.
- The specification — Aksu Index v1.0, CC BY 4.0, frozen
- The analyzer — Agent Blast Radius, MIT, static, zero Flex Credits
- The corpus — 28 Apex cases, 21 adjudicated by a live org rather than by me
I got three things wrong along the way and the org corrected me each time. Those are written down too — the analyzer proposes, the org decides.
Salesforce developer · Agentforce data-authority research · Abuja, UTC+1