AI Engine uses Salesforce's security model rather than a separate one. Access is granted with two permission sets, and the agent reads your Salesforce data with the running user's own permissions, within the scope your admin set in Agent Objects. This article explains both, for admins and security reviewers.
The two permission sets#
AI Engine Admin (AI_Engine_Admin) |
AI Engine User (AI_Engine_User) |
|
|---|---|---|
| Intended for | Admins who configure AI Engine | Everyone who uses the chat, actions, scoring, PDFs and Magic Snap |
| AI Engine configuration (Org Profile, Agent Objects, prompt templates and data sources, PDF templates, scoring configuration) | Create, read, edit and delete (scoring configuration: no delete) | Read only |
| AI Activity Log | View and modify all records | Read (with a Private org-wide default, only the user's own records) |
| AI score fields on Lead and Opportunity | Read and edit | Read and edit |
| User External Credentials | Not included | Read, which Salesforce requires for calling the AI provider |
Assign admins both permission sets. AI Engine Admin opens the admin panel and the Activity Monitor. AI Engine User carries what the AI features rely on, such as Read access to User External Credentials, and automatic scoring starts only for users who have it.
A few rules that follow from how access is checked:
- AI Engine checks the custom permissions that come with these permission sets. Assigning them directly or through a permission set group both work.
- The System Administrator profile does not grant access on its own. An admin without the permission sets sees "AI Engine access required".
- Users also need access to the AI provider credential. That is granted separately; see API keys and Named Credentials.
For assignment steps, see Assign permission sets.
How data access works#
The agent reads records with the user's permissions and field-level security. This applies to record actions and to the queries the AI writes from a chat question:
- Sharing: only records the user can see in Salesforce are returned. Records outside their sharing are not returned, so they are not sent to the AI.
- Object permissions and field-level security: if a question needs a field or object the user cannot read, the query is refused and the answer says that this part cannot be answered with the user's permissions. The agent does not guess.
- Agent Objects on top: the chat can only query objects your admin enabled and set to Active in Agent Objects (Task, Event and User are always available), and the AI is told only about the fields enabled there. A user's own access can narrow this further, never widen it.
- Read-only queries: queries generated by the AI can only read data. Statements that try to change data are refused.
When AI Engine writes data#
- Actions a user clicks (create a task, send an email, save a PDF to Files, save a Magic Snap lead or account) run with that user's permissions. The user needs the matching Salesforce permissions, for example to create Tasks or Files, and must be able to see the record the item is attached to.
- AI scores are written to the four
AI_Scorefields on Lead and Opportunity. Automatic scoring on create or change starts only for changes made by users who have the AI Engine User permission set, so integration users without it do not trigger scoring. A scheduled scoring batch runs as the admin who scheduled it and scores the records that user can see. - The activity log is written by AI Engine itself when an action runs. Users do not need create or edit access to the log object, and the AI Engine User permission set gives them read access only.
The activity log and sharing#
AI Activity Log records are owned by the user who ran the action. With the org-wide default set to Private:
- Users can read their own log records.
- While Grant Access Using Hierarchies is selected for the object in Sharing Settings, managers can also read the records of users below them in the role hierarchy. Clear that checkbox if managers should not see their team's AI usage.
- Admins with AI Engine Admin can see all log records.
New installations start with Private. Check the value in your org; see Recommended security settings.
Cloning the permission sets#
If you clone AI Engine Admin or AI Engine User, the clones do not receive changes from package upgrades. New fields, objects or permissions added in an upgrade have to be added to the clones by hand, otherwise users of the clones may lose features or see errors. Assign the packaged permission sets where you can.