What a connected AI tool can and cannot see.
Your existing Salesforce permissions decide it. Not ContextWorks, and not the agent.
There is no second security model.
ContextWorks is a Salesforce-native application. It does not copy, sync or index your data — every payload is assembled at call time from live records in your org.
Every query runs as the person asking, in user mode, through the object permissions, field-level security and sharing rules you already maintain. Two people asking the same question through the same tool get different answers, correctly.
Agents cannot change anything unless you deliberately turn writes on, and every write that happens is logged.
The technical documentationOne request · one record
Acme — 5,000 Widgets
7 fields returned
5 fields returned
Margin % and Approved Discount are not in this payload. Field-level security did not permit them, so they were never queried.
Permissions, writes, and where the data goes.
- 01
Your permissions decide it
Permissions are applied to the query itself, in user mode — the same object permissions, field-level security and sharing rules a report gets. A field the caller cannot see is absent because it was never retrieved, not fetched and then hidden.
- 02
Writes are off by default
Write access must be enabled at the org, domain, entity and field level before an agent can change anything. Every write runs as the user, previews as a diff, and is logged durably. Reads are counted rather than recorded.
- 03
Nothing leaves the platform
No copy, no sync, no external index, no vector store. Every payload is assembled live, inside your org, on your Salesforce infrastructure. An Agentforce call stays within the Einstein Trust Layer; on MCP it goes to the client you chose, under your agreement with that vendor.
