How to Implement AI in Salesforce: A Rollout Plan from Sandbox to Production

Admins asked to "add AI to the CRM" usually have the same worry: how do you implement AI in Salesforce without exposing data nobody meant to share, or rebuilding the setup when it moves to production? The answer is an ordinary rollout plan, done in the right order.

This guide walks through that Salesforce AI rollout plan for AI Engine, a managed package that runs inside Salesforce and calls your own AI provider.

How to implement AI in Salesforce: start with the requirements

AI Engine runs on editions such as Enterprise, Unlimited or Developer Edition, in Lightning Experience only, with your own API key from OpenAI, Anthropic or Azure OpenAI. One detail catches people in sandboxes: Send Email needs outbound email set to All email, and new sandboxes start at System email only. See Requirements.

Step 1: Install in a sandbox first

A sandbox is the recommended place for the first installation. Open the installation link as a System Administrator, replace login.salesforce.com with test.salesforce.com, check the org name on the install screen and choose Install for Admins Only.

Installing adds nothing to any page and does not start the trial, which begins the first time someone uses an AI feature.

Step 2: Connect your AI provider

AI Engine calls the provider through a Salesforce Named Credential. Your API key sits in an External Credential in your own org. The setup has four parts:

1. An External Credential with the key in a custom header.
2. A Named Credential with the provider's base URL and CloudConnected under Allowed Namespaces for Callouts.
3. Access to the credential's principal, through a permission set of your own, for everyone who uses AI Engine.
4. The Named Credential's exact name in the AI Engine Org Profile, together with the provider and model.

On Azure OpenAI, read Azure OpenAI in Salesforce first. Full steps are in Connect your AI provider.

Step 3: Choose objects and fields

In Agent Objects, an object that is not active does not exist for the agent. Within an active object, the fields you tick are the ones the AI is told about.

• Start narrow. Account, Contact, Lead and Opportunity, plus the two or three custom objects your reps use most.
• Fewer fields, smaller requests. Every ticked field is described to the AI with each chat question.
• Flag personal data with Mask as PII. With Allow PII off, flagged fields are replaced with placeholders before anything goes to the provider. More in PII masking for Salesforce AI.

Your selection never widens access. The agent reads data with the running user's permissions, so sharing and field-level security still apply.

Step 4: Assign permissions

AI Engine User goes to everyone who uses AI Engine; AI Engine Admin to the people who configure it. Admins who also use the chat need both. Use them as they are: a cloned copy does not receive package updates.

A permission set alone is not enough. A user with AI Engine User but no access to the credential's principal sees the chat, and every AI request fails.

Step 5: Run a first test as a real user

Admins see everything, so they pass tests ordinary users fail. Log in as a user with the same profile as your reps, AI Engine User and credential access, then check:

Test	What a pass looks like
Ask "How many leads do I have?"	An answer built from your data
Ask for open opportunities by close date	A table with the columns you expect
Next Steps and Draft Email on a record	A result about that record
A question in your team's language	The answer comes back in that language
Generate AI Score (if scoring is set up)	A score, a label and a reason
Activity Monitor	The test calls, with status ✓ OK

Also test a sparse record, a rich one and every app and record type with the components. See Run a first test.

Step 6: Run a pilot group

Start with a small group within your license's user limit, and include at least one experienced rep who is sceptical. Pick one task AI should make easier, such as meeting preparation or follow-up emails, and lead with it. Name an owner who collects feedback.

Step 7: Move the configuration to production

AI Engine stores its settings as records in the package's custom objects, not as metadata, so a change set does not carry them. To deploy AI to Salesforce production after the sandbox:

1. Install the package in production and assign the permission sets.
2. Recreate the External Credential and Named Credential and enter the key again. Credentials are never copied between orgs.
3. Re-enter the configuration, or for a larger setup export and import the records with Data Loader. Import prompt templates before their data sources, and do not copy record IDs.
4. Check the Org Profile: Named Credential name, models and any Azure deployment names.
5. Click ▶ Activate in AI Scoring again; the schedule is not copied.
6. Place the components on your Lightning pages.
7. Activate the license for the production org.
8. Run the first test again.

The details are in Move your configuration from a sandbox to production.

Step 8: Roll out and monitor usage

Keep the first session short, on users' own data. Tell them AI can be wrong: a drafted email is sent, and tasks, PDFs and Magic Snap records are created, only when the user confirms. Then use the Activity Monitor for the first four weeks:

• Week 1: see who has used it and talk to those who have not.
• Week 2: turn repeated questions into prompt templates.
• Week 3: check in with the most active user and the sceptic.
• Week 4: review the field scope in Agent Objects.

The Activity Monitor also shows estimated cost by feature; Salesforce AI token cost explains what drives it. AI Engine does not store the full text of prompts and answers: the activity log keeps usage metadata, plus a short error message when a call fails.

Summary

• Install in a sandbox first and connect your own provider through a Named Credential.
• Enable a narrow set of objects and fields, and flag personal data.
• Test as a real user, then pilot with a small group that includes a sceptic.
• Settings are records, so move them to production by re-entering or importing them, then recreate credentials, reactivate scoring and the license.
• Use the Activity Monitor to follow adoption, failures and cost.

Planning your own rollout? AI Engine installs as a managed package and works with your own OpenAI, Claude or Azure OpenAI key.