AGENTFORCE-1.4: Agent Write Without User Identity Binding
🔴 High · Excessive Agency
Detects Agentforce write/delete actions whose Apex/Flow target runs outside the end-user identity (without sharing or SYSTEM_MODE / system-mode Flow). Prompt injection can then change records the chatting user could not reach.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-1.4 |
| Severity | High |
| Category | Excessive Agency |
| Compliance | SOC2_CC6, NIST_AI_RMF, EU_AI_ACT_HIGH_RISK |
Remediation
Bind the action to the end-user: use 'with sharing' / 'inherited sharing' on Apex, AccessLevel.USER_MODE (or WITH USER_MODE) for dynamic SOQL/DML, and DefaultMode / user-context Flows. Also set isConfirmationRequired / require_user_confirmation to true for write and delete actions.