Every organisation adopting agents runs into the same wall at roughly the same moment. Three agents go live. Six months later there are eleven. Nobody can say with confidence which ones are still running, who owns them, what data they can reach, or whether the answer they gave a customer last Tuesday was correct.

Salesforce’s answer, announced around Dreamforce 2026, is the AI Control Plane: one place to see, manage, and control agents and AI as they spread across the enterprise. It ships alongside a broader architectural idea — the Enterprise AI Harness — and together they represent something administrators should pay close attention to: governance stopped being overhead and became the product.

The Enterprise AI Harness in plain terms

The Harness is a composable architecture that ties together six capabilities: context, agency, action, governance, security, and models. It draws on core technology from Data 360, Informatica, MuleSoft, Agent Fabric, Tableau, Agentforce, Salesforce Guardian, and the Salesforce Platform.

The point of the architecture is reuse. Instead of each agent reinventing its own access to customer context, its own action library, and its own guardrails, capabilities are shared: context flows across agents and models, actions and workflows are invoked securely wherever needed, and governance and security apply consistently as AI moves through the business. Customers can take the whole system or pick only the pieces they need.

Why this framing matters: for two years, every agent project has been a bespoke build with a bespoke security review. The Harness is Salesforce arguing that agent infrastructure should be shared, governed, and composed — closer to how nobody rebuilds authentication for each new app.

The governance toolkit that arrived with it

Capability The problem it solves
AI Control Plane One place to see, manage, and control every agent in the enterprise
MCP Risk Scores Flags vulnerabilities before a tool connects to an agent, rather than after an incident
Security Mesh Unifies disaggregated security signals across a sprawling agent estate
Observability Center End-to-end health monitoring as agents multiply
Global Consent Manager Enforces privacy preferences consistently across regions
Optimization Agent Acknowledges that agents need tuning after deployment, not just building before it
Third-Party Agent Orchestration Coordinates work across Salesforce agents and external agents, including A2A-style interoperability

And it has started shipping

Since Dreamforce, the toolkit has moved from announcement to Setup. The Winter ’27 release (generally available October 12) adds Security Health Review, which replaces the point-in-time Health Check PDF with continuous findings, remediation steps, and an audit trail inside Setup. Scale Center surfaces org-health alerts and Agentforce-assisted root-cause analysis directly in Slack. Most notably for anyone following the MCP story: Security Center’s MCP Server Monitoring (beta) centralizes visibility into configured MCP servers across connected Salesforce tenants — including risk scores, suspicious server URLs, configuration changes, and who added each one. The control plane is no longer a keynote slide; it is a place you can click.

One more change raises the stakes: as part of Winter ’27, the Agentforce platform is being enabled by default in eligible orgs. No agent runs until someone builds and activates one — but the old informal policy of “we never turned it on” no longer exists. Governance used to be something you chose to start. Now it is something you have to choose to skip.

This is not only a Salesforce story

Worth knowing: standards bodies are moving in the same direction. NIST’s Center for AI Standards and Innovation announced an AI Agent Standards Initiative, asking industry for input on agent security, with early outputs focused on software and AI agent identity and authorization.

That direction is easy to read. As agents take autonomous action, the questions that get regulated are not “which model did you use” but “which business system is allowed to take action, on which data, through which channels, and under whose identity.” Those are architecture and governance questions — and they are exactly the territory Salesforce professionals have historically owned.

The uncomfortable part nobody says out loud

Governance tooling only works if someone actually does the governing. Salesforce can give you a control plane; it cannot give you an owner for each agent, a review cadence, or the discipline to retire an agent that stopped being useful four months ago.

There is also a genuine tension worth naming. The same architecture that makes agents governable also makes them easier to deploy — which means the number of agents in an average org is going to grow faster than the number of people responsible for them. A control plane solves visibility. It does not solve the staffing ratio.

Six questions to ask about your own agent estate

Question What a bad answer costs you
Can you produce a current agent inventory? You cannot govern what you cannot list
Who is the named owner of each agent? Drift with no one accountable
What data can each agent actually reach? An over-permissioned agent will use the access you forgot about
When was each agent last evaluated? Silent degradation, discovered by a customer
Which third-party tools connect to them? An unassessed integration is an open door — hence MCP Risk Scores
What is the retirement plan? Zombie agents consuming budget and trust indefinitely

Why this is good news for platform professionals

Agent governance is a discipline that did not exist three years ago, and it maps unusually well onto existing Salesforce skills: permission architecture, sharing models, data spaces, PII masking through the Einstein Trust Layer, and lifecycle management. Nobody is hiring a generic “AI governance officer” to configure permission sets. They are hiring people who understand both the platform’s security model and how agents consume it.

The AI Control Plane will not run itself, and the org that adopts agents fastest is usually the org with the messiest governance. That gap is where a career gets made — and unlike most AI career advice, it rewards the unglamorous skills: knowing your data, knowing your permissions, and being willing to write things down.