Open an Opportunity in a Salesforce org that’s been running for a few years. Count the fields. Two hundred is normal. Some are the ones your team lives in. Some were added for an integration that was retired in 2021. Some have picklist values nobody has chosen since the last reorg. One of them is almost certainly called something like Legacy_Sync_ID_DO_NOT_USE__c.
You know which ones matter. Your reps know. Your RevOps lead could tell you, from memory, that the renewal date lags a day because it comes from the CS platform, and that “Partner” on this object means reseller, not referral.
None of that is written down anywhere a machine can read it.
What an agent actually gets
Connect an AI tool to Salesforce today and it sees the object. All of it. Every field, including the eleven nobody has touched since 2019. Every picklist value, including the deprecated ones. Every related list.
What it doesn’t get is any signal about which fields are live, what they mean, or how to weigh them. CloseDate and Legacy_Sync_ID_DO_NOT_USE__c arrive at the same weight. A field label is the only semantic hint, and in a mature org, labels are frequently archaeology.
The model does what models do with that: it guesses. Usually well. Sometimes confidently wrong. And the next time, with a different phrasing, it may guess differently.
What happens next
From there, one of two things happens, depending on who notices first.
Security notices first, and the request is denied. Someone on the sales team asks to use Claude or ChatGPT with Salesforce. The person who has to approve it asks the only reasonable question — what exactly can this tool see? — and the honest answer today is: everything the user can. So the answer is no. Not out of obstruction. Because the only option on the table was total exposure.
Nobody notices until the answers are wrong. The connection gets approved, agents get built, and the numbers don’t reconcile. Two tools give two different answers to the same question. The meeting turns into an argument about which one to trust and what the number was counting in the first place. People stop using it.
Both come from the same place: the agent was handed everything and told nothing.
The three bad options
Teams that hit this end up choosing between:
- Open it all up. Chaos. Every tool gets everything, none of them read it the same way.
- Lock it down. Stuck. AI access isn’t allowed and the business goes without.
- Hardcode it. Headaches. A developer writes a field list into a prompt. It drifts within a month, separately on every surface, owned by whoever wrote it last.
The fourth option
Curate what’s exposed. Explain what it means. Enforce permissions per user. Leave the data where it is.
That’s what ContextWorks does. It sits between your Salesforce records and whatever AI you’re using — Agentforce, Claude, ChatGPT, a Flow, an MCP client — and delivers a curated, explained, permission-correct view of exactly what you chose to expose. 212 fields become the 22 that matter, with instructions attached.
The next few posts walk through how: what an entity is, how the pieces fit, why permissions are enforced rather than filtered, and why one definition can feed every surface.
