Which Model Is Your Agent Running?
A Practical Guide to Agentforce's Multi-Model Era
Ask three Salesforce admins which AI model their Agentforce agents run on, and you will usually get three wrong answers. One will say "GPT-4o, obviously." One will say "Claude — isn't that the whole Claudeforce thing?" And one will honestly say they never checked. All three are working in orgs where the model choice is quietly shaping cost, latency, compliance — and whether the agent passes its next evaluation.
Agentforce is now a multi-model platform, and knowing how the model layer actually works has become a real interview and exam topic. Here is the practical version.
The four options on the table
| Option | What it actually is | Think twice if… |
|---|---|---|
| Salesforce Default | A managed mix (currently GPT-4.1 for new-builder agents, GPT-4o for legacy ones). You cannot pick models inside it | You need a pinned model for a regulated workflow — the mix can change under you, and an agent that passed tests last month may run a different model this month |
| AWS-Hosted Claude | Anthropic Claude on Amazon Bedrock, running inside the Salesforce Trust Boundary | Procurement has not approved Anthropic as a sub-processor. Some IL5 government deployments ran with Anthropic models disabled for exactly this reason |
| Google Gemini | Gemini 3.5 Flash on Vertex AI — a speed-tier model, GA since the September announcement | You put it on long, multi-step sub-agents without testing that exact workload first. Flash is built for fast, high-volume turns |
| Koa | Salesforce's own CRM reasoning model, in pilot with six named customers; US general availability slated for winter 2026 | You need pricing in this year's budget, or your agent mostly writes free-form text — Koa was trained for routine CRM actions: updating opportunities, routing cases, scheduling follow-ups |
Where the choice actually gets made
Model choice in Agentforce sits at three levels: org, agent, and sub-agent — and the most specific setting wins. In Setup, the "Select Agentforce Model Option" setting sets the org default. A model_config in Agent Script, or the model picker in Agentforce Builder, overrides it per agent or per sub-agent.
That makes a mixed-model org normal, not an edge case. One org can legitimately run Gemini on a high-volume case-triage sub-agent, Claude on the trust-boundary-sensitive service agent, and Salesforce Default everywhere else. The reasoning model is not the only model in the loop, either — Salesforce moved topic classification to an in-house small model (HyperClassifier) and cut LLM calls before first output from four to two. The model you pick decides planning and action choice. It does not decide everything.
The detail that wins arguments in security reviews
Here is the fact most people miss. On Salesforce's Supported Models page, only Anthropic's Claude and Amazon Nova models are flagged as running inside the Salesforce Trust Boundary. Every OpenAI and Google model on the list is not. Concretely, for the AWS-hosted Claude option, Salesforce states that traffic stays inside its own virtual private cloud, connects to Bedrock over AWS PrivateLink, and that model providers cannot access customer data or retain anything.
If your org's AI project is stalled in a security review, that paragraph — not any benchmark leaderboard — is usually the argument that unblocks it. Salesforce is even candid about the catch: switching models is not a Friday-afternoon config change, because "Anthropic tends to be more sensitive to the nuances in the input payload." Your existing prompt templates will need re-testing. And even after you pick a model, some background tasks like sub-agent classification may still use Salesforce-owned models. The toggle is not a hermetic seal.
What this changes for exams and interviews
The Agentforce Specialist exam has always tested the idea that instructions guide while actions grant permission. The multi-model era adds a second layer to that logic: the model reasons, but the data and guardrails decide whether the reasoning is safe to act on. Expect scenario questions where two orgs run identical agents on different models and the correct answer comes down to grounding quality, permissions, or the trust boundary — not model preference.
That is also why the highest-leverage skill in this new menu is not model selection — it is everything the model sits on. Retrieval quality, harmonized data, and identity resolution are what make any of these four options produce correct answers. If you want to pressure-test that layer, the Data 360 Consultant practice tests cover grounding and data architecture in exactly the depth these scenario questions demand.
Bottom line: in a single-model world, admins could ignore the model layer. In a multi-model world, "which model is this agent running, where does its inference run, and what did we re-test after switching?" is a question someone in your org has to own. Be the person who can answer it.