Agentforce Is Now On by Default: A Governance Playbook for Mid-Market Teams

Sometime in the past few weeks, a switch flipped in your Salesforce org — and nobody on your team touched it. With the Winter '27 release, Salesforce began enabling Agentforce by default in every eligible org. Existing customers have been auto-enabled on a rolling basis since early September, new orgs get it the moment they're created, and the dedicated on/off toggle is being retired from Setup later in the release cycle. If your company runs Enterprise Edition or above with Foundations, Agentforce is almost certainly live in your org right now.

That's not a reason to panic. It is a reason to spend an hour this week understanding what changed, who in your org can now do what, and whether your permission model is ready for software that can act on its own. This post covers what Salesforce actually announced, why "enabled" doesn't mean "deployed," the risks that deserve real attention, and a seven-step governance audit any mid-market admin can run before Friday.

1. What Actually Changed

Here are the facts, stripped of the headlines. As part of Winter '27 — which finished rolling out to production orgs in October — Salesforce now enables Agentforce automatically in orgs that have access to it through their edition and licensing. Per Salesforce's release documentation and reporting from Salesforce Ben, that covers Lightning Experience orgs with Foundations on Enterprise, Performance, Unlimited, and Developer Editions, plus orgs on Agentforce 1 Edition. Auto-enablement for existing orgs began the first week of September 2026, and new orgs are enabled at creation.

The part that raised eyebrows: the Agentforce toggle on the Agentforce Agents page in Setup is being removed later in Winter '27. There's no dedicated decline checkbox. Salesforce says enablement comes at no additional cost and changes nothing about billing.

Two controls do remain, and they matter. Admins can still switch off the underlying Einstein setting on the Einstein Setup page, which disables the AI layer platform-wide. And individual agents can be activated or deactivated one by one in Agentforce Builder. So you haven't lost control of your org — you've lost the convenience of a single, obvious switch, and gained a capability you didn't schedule.

2. Enabled Is Not the Same as Deployed

Before anyone forwards this post to your CISO with alarm bells attached, one clarification: auto-enablement does not mean AI agents are now making decisions in your live workflows. No agent talks to a customer, edits a record, or triggers an action until someone in your org builds it, tests it, and activates it.

What enablement actually does is make the machinery available. Agentforce sections appear in Setup. Users who hold the right permissions can open Agentforce Builder and start creating. Think of it less like a robot showing up to work in your office, and more like a fully stocked workshop appearing overnight in a building where you haven't yet decided who gets a key.

That framing points directly at the real issue. The question isn't "is Agentforce dangerous?" It's "who in my org holds a key to the workshop, and what could they build without anyone reviewing it?"

3. The Risks Worth Taking Seriously

Permission debt comes due

Most mid-market orgs carry years of accumulated permission sprawl: profiles cloned from profiles, permission sets granted for a project that ended in 2023, org-wide defaults set to Public Read/Write because it was faster during go-live. Human users rarely exercise the full extent of what they're technically allowed to touch. An agent running under a user context will use whatever access it has, consistently and at machine speed. Agents inherit your permission debt — and then they spend it.

Shadow agents

Anyone holding the Manage AI Agents permission can build and deploy agents. If that permission is sitting inside a broad permission set — or if your admins never audited who has it, because until September it didn't matter — you've got a path for well-meaning employees to stand up AI automation with no change request, no security review, and no entry in your release log. That's the same shadow-IT pattern that gave us rogue spreadsheets and unsanctioned SaaS, now with write access to your CRM.

A bigger attack surface

Agents that read fields the outside world can write to are a genuine security consideration. The cautionary tale is ForcedLeak, a vulnerability chain disclosed by researchers at Noma Labs in 2025 and rated CVSS 9.4: it used prompt injection through the Web-to-Lead Description field — which accepts up to 42,000 characters — to manipulate agent behavior. Salesforce patched that specific vector in September 2025 with Trusted URLs Enforcement, but the underlying lesson stands. Any field that external users fill in and agents later read — lead descriptions, case comments, form submissions — is a place where instructions can hide.

Abandonment is the quiet cost

Gartner projects that over 40% of agentic AI projects will be abandoned by the end of 2027, with insufficient oversight cited as a primary cause. The orgs that end up on the wrong side of that number won't be the ones that moved slowest — they'll be the ones that moved without a plan. Default enablement makes it easier than ever to start without one.

4. The Seven-Step Governance Audit

Here's the practical part. Each step takes minutes, not days, and together they turn an unscheduled platform change into a deliberate decision.

1. Confirm your org's status. Go to Setup and search for Agentforce Agents. If the section is there and enabled, you're in the rollout. Note the date — your auditors may ask when this capability appeared.
2. Audit the Manage AI Agents permission. Run a report on every user, profile, and permission set that grants it. Strip it from anyone who doesn't have an explicit reason to build agents. This single step eliminates most of the shadow-agent risk.
3. Make the Einstein decision deliberately. If your company isn't ready for any generative AI in the org — for compliance, contractual, or readiness reasons — the Einstein Setup page still gives you a platform-wide off switch. Use it consciously or leave it on consciously; either is defensible, but drifting isn't.
4. Review the access any future agent would inherit. Check org-wide defaults on sensitive objects, sharing rules left over from old team structures, and connected app OAuth scopes. Apply least privilege now, before the first agent goes live — it's far harder to claw back afterward.
5. Map your externally writable fields. List the fields that web forms, portals, and email-to-case can write and that an agent might someday read. That list is your prompt-injection surface, and it belongs in your security documentation.
6. Update your change-management policy. Add AI agents to the same approval workflow you use for flows and integrations: a named owner, a documented purpose, a test plan, and a deactivation path for every agent that reaches production.
7. Write down your posture. One paragraph: "We have reviewed Agentforce enablement, our position is X, the next review is scheduled for Y." When a board member or customer asks what you're doing about AI governance, you'll have an answer that took thirty seconds to find.

5. Opt Out, Hold, or Lean In?

After the audit, you have three honest options. Opting out via the Einstein setting suits orgs with hard compliance constraints or serious unresolved permission debt — just calendar a review date so the decision doesn't fossilize. Holding — enabled but with tightened permissions and no active agents — is the right default for most mid-market teams: you keep the runway without the risk. Leaning in makes sense if you have a well-bounded use case, clean data, and someone accountable for the result; started deliberately, a first agent pilot is a reasonable Q4 project rather than a leap of faith.

The only wrong move is not choosing. Salesforce has made Agentforce present in your org; whether it becomes an asset or an audit finding is decided by what you do next.

The Bottom Line

Default enablement is Salesforce signaling, unambiguously, that agents are now a standard part of the platform rather than an add-on. You don't have to share that enthusiasm this quarter — but you do have to govern it. An hour of permission auditing this week beats an uncomfortable discovery during next year's security review.

If you'd rather have expert eyes on it, that's what we do. 360 Quantum Solutions has spent 16+ years in the Salesforce ecosystem helping mid-market B2B teams keep their orgs secure, tidy, and actually useful to sales. Start with our free 2-minute org health check at 360quantumsolutions.com, or book a 5-day org audit and we'll map your permission debt, your Agentforce readiness, and your cleanup plan — fixed fee, no scope creep, no surprises.