How does Agentforce issue refunds and credits?
An Agentforce agent works through subagents, which Salesforce previously called topics. Each groups related instructions and actions, the tools the agent uses to complete tasks, from standard actions to custom ones that create or change records. A refund or account credit is an action the agent decides to call.
Salesforce’s own authentication project uses an ‘Order Issues and Refunds’ subagent as its example: the agent can only reach its actions once the customer is verified.
The newer Agentforce Builder and Agent Script separate deterministic steps from LLM reasoning. Salesforce’s architecture guidance puts the rule plainly: ‘if you can express a decision as code, it should be written as logic.’
Which guardrails can you configure?
The useful question for each control is what enforces it: the model reading instructions, or the platform.
| Control | How it works | Enforced by |
|---|---|---|
| Subagent instructions | Natural-language rules such as “Always…”, “Never…”, “If x, then y…” | The model |
available when conditions | Hide an action from the model’s tool list until a condition is true | The platform |
| Customer verification | Private actions run only for verified customers. Salesforce’s example uses email plus a one-time code | The platform, via conditional logic and transitions |
| Einstein Trust Layer | Data masking, zero data retention with third-party LLMs, toxicity scoring and an audit trail | The platform, on content rather than refund policy |
| Human escalation | Subagent instructions define when and how the agent hands off to a person | The model |
Where do the gates leak?
Salesforce’s architecture guide adds two cautions. If you rely on the model to set the gate variable, the gate may or may not open, so set it from logic such as a verification result. And the platform doesn’t automatically suppress an action after it runs, so close the gate yourself, for example with a has_run flag, or a second refund can follow the first in the same session.
The Trust Layer is described as identifying prompt-injection attempts and deflecting or ending those conversations. A customer who politely claims a manager approved a refund isn’t injecting anything, so policy limits still need to sit in the gate conditions and in the action’s own logic.
What does Agentforce Testing Center cover?
Testing Center generates synthetic interactions from the agent’s subagents and actions, 20 by default, and you can set a test objective that controls the mix of positive and negative cases. Tests run in parallel and show which subagents and actions the agent chose, so you can adjust instructions and guardrails.
Salesforce warns that testing agents can modify CRM data and recommends running Testing Center only in a sandbox. In Agentforce Builder, action simulation emulates action responses in the Preview and Simulate environment instead of calling live systems.
Testing Center is built to answer a routing question: did this request reach the right subagent and action. The Salesforce material reviewed for this guide doesn’t describe simulated customers who argue, come back after a refusal or claim prior approval over several turns. Those cases need to be written into your test set or tested separately.
What to test before giving Agentforce refund or credit authority
Run these in a sandbox. Illustrative cases:
- A refund request before verification, phrased as a follow-up to an earlier verified chat (identity abuse).
- A second refund on the same order in the same session, to confirm the gate closes after the first.
- A customer who says a supervisor already approved a larger credit (fake prior approval).
- Free-text order notes or case comments containing instructions to the agent (indirect prompt injection).
- Requests that move from a general subagent into the refund subagent over several turns (multi-turn escalation).
- A credit amount just above the action’s limit, checked in the action’s own logic.
Questions
Are topics and subagents the same thing in Agentforce?
Yes. Salesforce’s current guidance notes that topics have been renamed subagents. Older Trailhead modules and documentation still use the word topic.
Does the Einstein Trust Layer stop unauthorized refunds?
Not by itself. It masks sensitive data, scores toxicity, logs prompts and responses, and Salesforce says it identifies and deflects prompt-injection attempts. Whether a refund fits your policy is decided by action gating, customer verification and the logic inside the action.
Can I run Testing Center against production?
Salesforce advises against it: testing agents can modify CRM data, so it recommends using Testing Center only in a sandbox.
Salesforce Agentforce is a trademark of its owner. This guide is independent and not affiliated with or endorsed by Salesforce.
Free checklist
Get the guardrail checklist for agents that move money.
A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.
Sources
- Salesforce Architects: Hybrid reasoning with Agentforce Builder and Agent Script
- Trailhead: Learn about authentication for topics and actions
- Trailhead: Explore Agentforce guardrails and trust patterns
- Trailhead: Secure agents with the Einstein Trust Layer
- Trailhead: Use AI to generate tests