Salesforce in Claude: An Enterprise Architect's Pre-Pilot Checklist

Salesforce in Claude is the first Salesforce product built to run principally outside Salesforce - inside a general-purpose AI assistant, calling into your org over your org's own permission model. Announced on 26 August 2026 as the headline product of a new Claudeforce partnership between Salesforce and Anthropic, it is currently live for a small group of pilot customers and expected to open to a broader beta this month. For enterprise Salesforce architects, that timeline matters more than the launch headline: once Salesforce in Claude is available to whoever in your org signs up for it, an org with loose permission hygiene inherits a much larger blast radius the moment someone turns it on.

What Salesforce in Claude actually is

Claudeforce is the umbrella term for a broader partnership, and it covers three separate things: Model Context Protocol (MCP) support built into the Salesforce platform, the Salesforce in Claude plugin itself, and Claude's presence inside Slack through Agentforce 360 (Salesforce's rebranded platform, unifying the Agentforce Platform, Data 360, Customer 360 apps and Slack). Salesforce in Claude ships first with 37 prebuilt sales skills covering meeting preparation, deal-health reviews, and pipeline analysis, letting sellers query, update, and act on live CRM data from inside a Claude conversation instead of opening Salesforce. Salesforce says additional skills for other functions will follow "later in 2026", with no scope or date confirmed yet - which is exactly why this is a decision worth running past an outside Salesforce architecture review rather than deciding on a single admin's judgment call.

We're delivering a dynamic interface that thinks, reasons, and acts.

Marc Benioff, Salesforce Chair and CEO, 26 August 2026

How the access model actually works

The mechanism matters more than the branding. Salesforce in Claude runs on Anthropic's Model Context Protocol, extended by MCP Apps (a formal MCP extension published in January 2026) that lets a model discover and call approved tools instead of being handed raw API credentials. On the Salesforce side, this rides on Salesforce Hosted MCP Servers, which reached general availability in April 2026 for Enterprise Edition orgs and above - a real, shipped capability that exists independently of the Claude pilot and is worth evaluating on its own merits.

Salesforce describes the connection as running as the connected user, not as an integration user or a service account with broad "View All" access. Sharing rules, field-level security, profile permissions, and permission sets apply exactly as they would if that person were clicking through the Salesforce UI themselves. Every prompt and response also passes through the Einstein Trust Layer, which Salesforce says masks personally identifiable information before it reaches the model and screens outputs for toxicity. Write actions - anything that changes a record or sends a communication - go through configurable guardrails; Salesforce's own example is requiring explicit confirmation before Claude emails anyone outside the company.

• The existing sharing rules and role hierarchy assigned to the logged-in user
• Field-level security and permission sets already attached to that user's profile
• Whichever MCP tools and objects an admin has chosen to expose - this is configurable, not all-or-nothing
• Einstein Trust Layer masking rules for fields flagged as sensitive
• Org-level write-action policies that admins define once, centrally, rather than per user

What's GA, what's beta, and what Salesforce hasn't said yet

It's worth separating the shipped infrastructure from the pilot product sitting on top of it, because they carry very different levels of maturity.

That last row is not a minor omission. Salesforce's own launch materials for Salesforce in Claude do not specify pilot-selection criteria, pricing, regional availability, which Salesforce editions qualify, or which Claude plan a seat requires. Until that's published, any internal business case for a wider rollout is provisional, not a forecast.

Why this is a bigger decision than a normal feature launch

Compare it with how Agentforce agents work natively inside Salesforce. An Agentforce agent operates through topics and actions you define and test in Agentforce Studio - a bounded, inspectable scope. Salesforce in Claude instead hands a general-purpose model the same reach a human employee already has, and lets that model decide, turn by turn, what to look up or change. Neither approach is wrong, but they carry the risk in different places.

None of this is a reason to avoid piloting Salesforce in Claude. It's a reason to treat the pilot as a permission-hygiene exercise as much as a productivity trial. An over-permissioned profile has, for years, mostly rewarded whoever happened to click into the wrong record - the data was reachable, but someone had to know it existed and go looking for it. A conversational interface turns any question that can be phrased in English into a query across that same access. That's a genuine productivity gain and a genuine escalation of whatever the permission model already got wrong, at the same time.

A pre-pilot checklist for Salesforce architects

1. Audit permission sets and profiles for the specific pilot cohort - not the whole org - before enabling anything.
2. Decide, in writing, which write actions require human confirmation, and configure that centrally rather than per user.
3. Confirm exactly which MCP tools and objects are exposed; don't accept an unscoped "everything" connection by default.
4. Map Einstein Trust Layer masking rules against your actual sensitive fields - health, financial, national ID, or industry-specific data - since default masking won't be correct for every industry out of the box.
5. Get legal and compliance sign-off on Anthropic's data-processing terms before any production data is involved.
6. Scope the pilot to a small, named group with logging enabled, not "anyone who wants to try it."
7. Ask your account executive, in writing, for pricing, required edition, and required Claude plan - none of it is public yet.
8. Define a rollback path: how you disable access for one user, or the whole org, without disrupting other Salesforce automation.

What we're advising clients right now

This is exactly the kind of decision where an outside architecture and governance review earns its keep before a dollar is spent on licensing. If your org's permission model was designed for people clicking through page layouts - not for a model executing SOQL-shaped questions on behalf of your whole sales team - it's worth a targeted access review before your name reaches the pilot list. We've built and hardened Agentforce capabilities inside live Service Cloud environments as part of enterprise engagements, including case-summary agents that had to respect exactly this kind of permission boundary, so we know how quickly a reasonable-looking profile turns into an unreasonable amount of exposure once something can ask it questions all day.

Our senior architects are already fielding pilot questions from clients who were invited before Salesforce published any pricing or eligibility details. If you're in that position, or expect to be once the open beta lands, it's worth getting a second opinion on your permission model before you commit a team to the pilot rather than after something goes wrong inside it.

The bottom line

There is real, generally available infrastructure underneath Salesforce in Claude - Hosted MCP Servers didn't appear overnight, and MCP Apps is a genuine open protocol extension, not marketing language. But the product sitting on top of that infrastructure is still a pilot heading toward an open beta with undisclosed pricing, undisclosed eligibility, and a skill set limited to sales for now. The sensible response is neither to wait passively nor to rush a broad rollout the moment it's available to more users. Use the pilot window to fix the permission model you should want regardless of whether an AI assistant ever touches your org - because whether or not you pilot Salesforce in Claude this quarter, something eventually will act on your users' behalf with exactly the access those users already have.