AGENTFORCE-19.2: CDC Without Field Filter in Agent Context

🔴 High · Platform Event Security

Detects Change Data Capture triggers that deliver unfiltered field changes to agent contexts. CDC triggers run in system context and bypass FLS — without getChangeEventHeader().getChangedFields() filtering, all changed fields (including restricted PII) are passed to the agent.

Details

Field	Value
Rule ID	AGENTFORCE-19.2
Severity	High
Category	Platform Event Security
Compliance	SOC2_CC7, NIST_AI_RMF

Remediation

Refer to the SquireX documentation for remediation guidance specific to AGENTFORCE-19.2.

See Also

• Rule catalog index
• SquireX scan documentation