Salesforce's AI Harness: Six Trust Layers, One Control Plane

What you need to know

• Salesforce introduced the Trusted Enterprise AI Harness on 10 September 2026, ahead of Dreamforce: a composable architecture with six capabilities, Trusted Context, Agency, Action, Governance, Security and Models.
• A new AI Control Plane sits above the six layers to discover and register agents, set identity and policy, manage lifecycle, evaluate performance, observe behaviour and control cost, across Salesforce and third-party AI.
• It is built headless, exposed through MCP, APIs, Skills and Plug-ins, and extends into Claude, Slack, Microsoft Teams and Agentforce.
• Timing is the catch. Foundations are available now; the new capabilities and unified experience arrive in early fiscal FY28, February 2027 at the earliest. Pricing is to be announced.
• The buyer problem is real. VentureBeat's July 2026 survey of 107 enterprise respondents found 85% run two or more agent orchestration platforms, averaging 3.1 each.

Strip the branding and this is a procurement checklist: six headings describing what a large regulated organisation believes it needs before an agent touches customer data. The list will outlive the product, because buyers will start asking every supplier, including you, whether your agent has each layer.

A harness is a product now, not a pattern

For most of 2026, “harness” has meant the developer thing: a model in a loop, a tool registry, a permission layer and an evaluation feedback path. Rohan Kumar, Salesforce's President and Chief Platform and Engineering Officer, drew that distinction in his briefing, as reported by SalesforceDevops.net, and argued the enterprise version is much bigger: securing the agent, governing it and building its context all have to come together. His sharper line, per the same report: where you run your agents, and the code of the agents, is going to become a commodity.

That answers the question we raised when OpenAI took agents in-house and when Microsoft shipped Agent 365: the labs are moving up into the runtime, the enterprise vendors down into governance, and the developer harness is squeezed from both ends.

The six layers, in plain terms

Trusted Context is the customer data, metadata, semantics, knowledge, real-time signals and memory an agent reasons over. Trusted Agency is the loop: reasoning, planning, state, memory, collaboration and orchestration, with deterministic controls alongside the flexible parts. Trusted Action connects the agent to applications, APIs, workflows and processes. Trusted Governance covers data, metadata, policies, lineage, quality and controls. Trusted Security is identity, permissions, privacy, data protection and runtime security. Trusted Models is model selection with routing on accuracy, performance and cost.

Unite.AI's write-up lists the products underneath: Data 360, Informatica, MuleSoft and Agent Fabric, Tableau, Agentforce, Salesforce Guardian and the Salesforce Platform.

Why the control plane matters more than the layers

The six layers describe agents Salesforce builds. The AI Control Plane is aimed at agents everyone else builds: discover and register them, establish identity and policy, manage lifecycle, evaluate performance, observe behaviour and outcomes, and control cost, explicitly including third-party AI. Kumar told VentureBeat that customers do not have to pick everything from Salesforce, and SalesforceDevops.net describes the plane as an evolution of MuleSoft's API management, with a registry view organised around what each agent costs.

That is the design a builder should notice. If your agent is deployed inside a bank in Mumbai or an insurer in Leeds that adopts this, it becomes a row in someone else's registry, with a policy attached, a cost ceiling and a behaviour trace you did not write. That is not hostile; it is what we argued for in our guide to building your own agent control plane. But the sales question shifts from “what does your agent do?” to “can it be registered, scoped, observed and capped by our plane?”

VentureBeat notes Microsoft Agent 365 has been generally available since May 2026 and AWS's Bedrock AgentCore Harness since June 2026. Salesforce's control plane is a 2027 product competing with 2026 products, and the customer quote it chose, Rocket Mortgage CTO Shawn Malhotra saying “we don't want to bet our future on one closed stack; we want the freedom to adapt”, is aimed at that gap: late and open beats early and closed.

What this tells you about regulated buyers in the UK and India

Salesforce read these headings off its customers, and its customers in the two markets we cover have the longest questionnaires. As of September 2026, an FCA-regulated firm in London already asks about operational resilience, third-party risk and accountability under the Senior Managers regime (we covered the Bank of England, FCA and ICO's direction of travel in Britain's frontier-AI reckoning). An NHS supplier faces the Digital Technology Assessment Criteria and a data-protection impact assessment. In India, a bank or NBFC under RBI's outsourcing and IT governance directions wants to know where data sits and who can see it, and with the DPDP Rules phased in and the main obligations landing by May 2027, the questions arrive before the enforcement date does.

Map those questions onto the six layers and the fit is close. “What data can the agent see and where did it come from?” is Trusted Context plus the lineage half of Trusted Governance. “What can it do without a human?” is Trusted Action. “Who is it acting as, and can we revoke that?” is Trusted Security. “Which model answered, and can we swap it?” is Trusted Models. The harness answers a questionnaire that already exists in Canary Wharf and Bandra Kurla Complex; your agent will face the same one.

The DIY map: six layers a small team can stand up

None of the six capabilities is exotic; each has an open or low-cost equivalent a team of three in Bengaluru or Bristol can run. The tools named below are examples of the category, not endorsements. The aim is a credible answer for every row when a buyer's platform team asks.

Three rows have full guides here: the Trusted Action row is the tool-permission boundary problem, the Control Plane row is instrumenting agents with OpenTelemetry and cost attribution, and the Trusted Models row is the gateway comparison. The whole table is perhaps a month for a small team if you are disciplined about scope.

Where the comparison is unfair, in both directions

It is unfair to Salesforce to call the DIY table equivalent. Trusted Context in a Salesforce org is decades of customer data with metadata and semantics already attached, not a vector store. Kumar's central claim, that the model is ubiquitous and the trusted, proprietary context is what differentiates an enterprise, is correct, and a small team's context layer is thin by comparison.

It is unfair to you to suggest that means waiting. Nothing ships as a unified experience before 2027, pricing is unknown, and SalesforceDevops.net's critique stands: no public composability proof, no partner list, no published capability swap. The managed runtime versus own harness decision ladder applies unchanged: the more your differentiation lives in the loop and the actions, the less sense it makes to wait for someone else's harness to define them. Borrow the shape, not the product.

What to do this quarter

Before any of this reaches general availability, five moves put a builder ahead of the questionnaire.

• Give every agent an identity. A service account, a scoped credential and a name in a registry, even if the registry is a table with ten rows.
• Split read tools from write tools and gate the writes. Trusted Action is, in practice, an allow-list plus a human approval step for anything irreversible; MCP elicitation gives you that step.
• Trace with cost on every span. A buyer who sees per-run cost in your traces will believe your ceilings; one who does not will impose theirs.
• Route through a gateway, and prove the swap. Run your eval set against two providers and keep the result; “we can swap the model” is a claim, a passing regression suite is evidence.
• Document lineage for what the agent reads. One paragraph per source: origin, freshness, owner, residency. For an Indian bank that is an RBI conversation, for an NHS trust a DPIA. Our data residency guide covers the routing side.

The honest read

Salesforce has not shipped a harness. It has shipped a definition of one, with a 2027 delivery date and no price, timed so buyers carry that definition into 2027 budget conversations. That is a reasonable strategy for a company whose foundations already sit in most of those buyers' data estates; its competitors, from Microsoft to Google's Gemini Enterprise agent platform, tell a version of the same story.

For a builder in India or the UK, the useful output is the checklist. Six layers and a control plane is a fair summary of what a regulated enterprise wants from any agent, and every layer has an open equivalent you can stand up before the vendor version exists. Do that work now and write it up: a documented, scoped, traced, model-portable agent is the same asset in Mumbai as in Manchester, and far more persuasive on a Builder profile than a demo that only runs on your laptop.