Security Rules Reference

192 rules across 85 categories — 🚨 49 critical, 🔴 110 high, 🟡 27 medium, 🟢 6 low.

Action Configuration

Rule ID	Severity	Name	Description
AGENTFORCE-1.2	🔴 High	Schema Synchronization Verification	Detects GenAiFunction schema

Agent Script Safety

Rule ID	Severity	Name	Description
AGENTFORCE-2.1	🟡 Medium	Validation Guard Clause Enforcement	Detects when Agent Script invokes state-modifying actions (Apex/Flow targets) without preceding validation logic such as conditional guards or available_when clauses
AGENTFORCE-2.3	🟡 Medium	Prompt Injection Defense Heuristics	Detects when dynamic user input variables are injected into prompt templates or agent instructions without defensive boundary patterns, creating vulnerability to prompt injection attacks that can override system instructions and bypass security policies

MuleSoft Agent Fabric

Rule ID	Severity	Name	Description
AGENTFORCE-AF-01	🚨 Critical	Broker PII Routing Without Guard	Detects Agent Fabric brokers that route requests to agents processing PII-classified fields without PII output guards
AGENTFORCE-AF-02	🔴 High	LLM Provider Without Rate Limit	Detects LLM provider configurations in Agent Fabric that lack rate limiting controls
AGENTFORCE-AF-03	🔴 High	A2A Card Overpermissioned Scope	Detects A2A Agent Cards that advertise sensitive capabilities (database writes, deployments, payments) without requiring strong authentication (mTLS, OAuth2)
AGENTFORCE-AF-04	🔴 High	Broker Privilege Escalation via Routing	Detects Agent Fabric brokers with routing strategies (fallback, round-robin) that route across agents at different privilege levels
AGENTFORCE-AF-06	🔴 High	Agent Fabric Broker Write Tool Without Approval	Detects Agent Fabric brokers whose LLM can call a state-changing MCP tool or A2A agent (create/update/delete in Salesforce, Workday, a database, Jira, ServiceNow, SAP, …) with no human approval step
AGENTFORCE-AF-08	🔴 High	Agent Fabric Connection Without Authentication	Detects Agent Network connections to A2A agents and MCP servers (context
AGENTFORCE-AF-09	🔴 High	Unauthenticated MCP / A2A Agent Endpoint	Detects Mule MCP servers and A2A servers, and Agent Fabric broker interfaces, that accept calls with no authentication visible in the repository (no API autodiscovery / API Manager policy, no security filter, no A2A task authorizer, no inbound broker policy)
AGENTFORCE-AF-11	🔴 High	Agent Tool Writes to System of Record	Detects Mule MCP tools and A2A agents whose flows write to Jira, Workday, a database, ServiceNow, Salesforce, SAP, NetSuite or Dynamics and are reachable by an LLM (chosen by a broker LLM, or served without authentication)
AGENTFORCE-AF-15	🔴 High	Mule SSRF via Request-Controlled URL	Detects <http:request> calls whose url or host comes from request input (query / URI parameters, headers, payload, or variables set from them) in MCP tool flows, A2A task flows, or HTTP endpoints of an app that serves MCP / A2A, with no validation of the target
AGENTFORCE-AF-16	🔴 High	Mule A2A Authorizer Allows Every Request	Detects A2A task-authorizer flows that approve every task: a wildcard verb / skill list, or a constant allow with no check of the caller's identity, token or requested skill
AGENTFORCE-AF-17	🔴 High	Write Tool on Unauthenticated Mule MCP Server	Reports each MCP tool that writes to a backend system, at its <mcp:tool-listener>, when the Mule MCP server has no authentication in the repository (no autodiscovery, no security filter) and listens beyond loopback
AGENTFORCE-AF-05	🟡 Medium	Bidirectional Agent Communication Without Broker	Detects agents in the Agent Fabric that can communicate bidirectionally (Agent A calls Agent B and Agent B calls Agent A) without a mediating broker to control the conversation
AGENTFORCE-AF-07	🟡 Medium	Agent Fabric Broker Unconstrained Autonomy	Detects Agent Fabric broker LLM nodes that pick freely among three or more actions, including writes or delegation to other agents, with no loop cap, no INPUT_REQUIRED hand-back to the user and no inbound policy on the broker, so one request can chain many consequential calls
AGENTFORCE-AF-10	🟡 Medium	A2A Agent Card Without Security Scheme	Detects A2A agent cards (Agent Network registry agents, broker interfaces, Mule A2A server cards) with no securitySchemes or security requirements
AGENTFORCE-AF-12	🟡 Medium	Over-Broad Agent Fabric Registry Tool Access	Detects Agent Network registry agents and v1 brokers that reference an MCP server with no allowed tool list while the server exposes write tools, so the agent can call every current and future tool
AGENTFORCE-AF-14	🟡 Medium	Mule Outbound TLS Validation Disabled	Detects <tls:trust-store insecure="true"/> on outbound Mule connections (HTTP request configs, MCP / A2A clients, OAuth token calls) in apps that serve or call agents: any certificate is accepted, so the peer can be impersonated
AGENTFORCE-AF-13	🟢 Low	Agent Fabric Broker Without Rate-Limit Policy	Detects Agent Network v2 brokers with no rate-limiting, spike-control or token-limit policy on their A2A ingress or on the LLM connections they use, so a single caller can run unbounded LLM loops

ServiceNow Action Fabric

Rule ID	Severity	Name	Description
SNOW-AF-06	🔴 High	Inline Agent Tool Script Without Record ACL	Detects inline sn_aia_tool scripts that query or change business records with plain GlideRecord (which skips ACLs) instead of GlideRecordSecure, so the agent can read or change rows the user should not see
SNOW-AF-08	🔴 High	Unauthenticated Agent MCP Client Connection	Detects a ServiceNow Action Fabric MCP client (or agent connection) with no authentication, so the agent calls that server anonymously
SNOW-AF-09	🔴 High	Public or Unauthenticated Action Fabric Endpoint	Detects an Action Fabric MCP server with no authentication, or an AI agent published for A2A with a public flag, a Public security ACL, or allow-third-party
SNOW-AF-11	🔴 High	Agent Tool Can Change a System of Record	Detects an AI Agent Studio tool whose operation, Flow, or script can create, update, or delete records in a system of record
SNOW-AF-14	🔴 High	Agent Writes HTML or [code] Markup Into Work Notes	Detects ServiceNow AI Agent tools/scripts that insert HTML or [code] journal markup into work_notes / comments from LLM or user input
SNOW-AF-10	🟡 Medium	A2A Agent Card Without a Security Scheme	Detects a ServiceNow A2A agent card that advertises no security scheme
SNOW-AF-13	🟢 Low	Autopilot Tool Without an Execution Cap	Detects an autopilot agent-tool binding with max_auto_executions missing, zero, or very high (100 or more), so one turn can call the tool in a loop

Supply Chain Security

Rule ID	Severity	Name	Description
AGENTFORCE-SC-02	🔴 High	Silent Schema Desync Exploit	When a schema
AGENTFORCE-SC-03	🟡 Medium	Managed Package Origin	Detects when AI agent actions invoke Apex classes or Flows from managed packages (third-party code)
AGENTFORCE-SC-01	🟢 Low	Agent Metadata Below API v64	The project contains GenAiPlannerBundle metadata (API v64

Agent Authority

Rule ID	Severity	Name	Description
AGENTFORCE-36.1	🔴 High	Agent-Invoked Apex Exercises Authority Without a User Guard	Follows agent actions (GenAiFunction / ActionDef / Agent Script apex:// targets and the classes they call; @InvocableMethod classes in projects with agent metadata) into Apex that changes authority: inserts or updates PermissionSetAssignment, PermissionSetLicenseAssign, GroupMember, UserRole, User, team members or *Share rows; reassigns OwnerId; sets or resets passwords and manages users; or writes an SObject whose type comes from run-time input

Agent Flow Integrity

Rule ID	Severity	Name	Description
AGENTFORCE-2.2	🟡 Medium	Transition Integrity	Every agent topic should either transition to another topic or define actions that perform useful work

Agent Network Security

Rule ID	Severity	Name	Description
AGENTFORCE-AF-22	🚨 Critical	Unsafe Deserialization in A2A Agent Server	Detects Java agent servers (A2A, MCP or agent-framework projects) that deserialize data with APIs that let the input choose which classes to build: ObjectInputStream
AGENTFORCE-AF-21	🔴 High	A2A Task Endpoint Without Authentication	Detects A2A agent servers written in Java (JAX-RS / Quarkus / Spring, or the A2A Java SDK) whose task endpoints (message/send, message/stream, tasks/get, tasks/cancel, push-notification config) accept requests with no authentication: no @RolesAllowed / @Authenticated / @PreAuthorize, no principal or identity check, no security filter or framework auth policy; or whose security filter fails open (lets requests through when no credential is configured or on an exception)

AgentExchange Supply-Chain

Rule ID	Severity	Name	Description
AGENTFORCE-SC-10	🚨 Critical	Tool Namespace Shadowing (Confused Deputy)	Detects when third-party AgentExchange plugins register tools with API names identical or similar to core Salesforce internal functions, or embed cross-origin shadowing directives in their description fields
AGENTFORCE-SC-11	🔴 High	Unbound Gateway Activation	Detects agents active in Salesforce metadata but absent from Agent Fabric (Flex Gateway) governance policies
AGENTFORCE-SC-12	🔴 High	Transitive Prompt Poisoning	Detects meta-prompting instructions in third-party plugin instruction definitions that attempt to override core system instructions or bypass enterprise guardrails

Agentforce for Commerce

Rule ID	Severity	Name	Description
AGENTFORCE-17.1	🚨 Critical	Commerce Agent Without Idempotency Key	Detects agent actions targeting Apex classes that make HTTP callouts to Commerce or Order Management APIs without including an Idempotency-Key header
AGENTFORCE-17.2	🚨 Critical	Commerce Agent Amount Without Bounds Check	Detects Apex invocables called by Commerce agent actions that manipulate Amount, Quantity, or Price fields without validating bounds

Agentic Architecture

Rule ID	Severity	Name	Description
AGENTFORCE-7.1	🔴 High	Topic Action Bloat (God-Topic Prevention)	Detects Monolithic 'God Topics' configured with 5 or more actions
AGENTFORCE-7.2	🔴 High	Inadequate Skill Semantics	Detects GenAiFunctions and Agent Actions with missing or dangerously brief (<20 chars) descriptions
AGENTFORCE-8.1	🔴 High	Context Traversal Exfiltration (ForcedLeak Mitigation)	Detects Deep Object Graph Traversals in Agent Prompts
AGENTFORCE-7.3	🟢 Low	Orphaned Bot Without AiEvaluationDefinition	Detects deployed Bots/BotVersions that have no corresponding AiEvaluationDefinition in the repository

Autonomous Scheduling

Rule ID	Severity	Name	Description
AGENTFORCE-11.1	🚨 Critical	Unguarded Autonomous Scheduled Action	Detects agent actions that invoke Scheduled Apex or Batch Apex without requiring user confirmation
AGENTFORCE-11.2	🔴 High	Time-Window Privilege Drift	Detects Scheduled Apex classes invoked by agent actions that declare 'without sharing' and perform DML

Broken Access Control

Rule ID	Severity	Name	Description
AGENTFORCE-25.3	🔴 High	SYSTEM_MODE Query Bypasses Sharing/FLS	Detects Database
AGENTFORCE-25.6	🔴 High	Apex without sharing Bypass	Detects Apex classes declared without sharing, which ignore record-level sharing rules and can expose privileged data to callers
AGENTFORCE-26.1	🔴 High	Record Access by Caller-Supplied ID Without Sharing (IDOR)	Detects Apex/Visualforce/LWC controllers and agent actions that read records by an id the caller or the AI supplies without sharing enforcement, USER_MODE or an ownership check (insecure direct object reference), and id inputs concatenated into Named Credential callout paths
AGENTFORCE-26.2	🔴 High	Agent Action Identity Parameter Without Session Binding	Detects agent action inputs that accept caller- or LLM-supplied identity handles (contactId, incident_sys_id, patientId, prechat contact fields) without evidence the implementation binds them to the authenticated session
AGENTFORCE-26.4	🔴 High	Agent-Called Apex Without Sharing or Permission Checks	Follows agent actions into the Apex they call (helpers included) and reports code that runs without sharing (declared, or inherited from an entry class with no keyword) while it writes without CRUD/FLS checks or reads / changes records by an id from the action input with no ownership check, and code that falls back to system context (a catch block or failed permission check that retries in SYSTEM_MODE or a without-sharing class)
AGENTFORCE-AF-19	🔴 High	Unauthenticated Endpoint Calls an Agent With the Server's Credential	Detects HTTP endpoints (Mule http:listener flows, Express / Next
AGENTFORCE-AF-23	🔴 High	A2A Task Cancel or Subscribe Without Ownership Check	Detects A2A servers (Python) that authenticate callers but implement tasks/cancel or tasks/resubscribe (on_cancel_task, on_resubscribe_to_task, cancel_task helpers or /tasks/{id}/cancel|subscribe routes) by looking the task up only by its id: the store call is not scoped by the caller's context, user or tenant and the handler never compares an owner or tenant field
AGENTFORCE-APEX-03	🔴 High	Unrestricted Guest or Agent File Upload	Detects Apex that inserts ContentVersion (or assigns VersionData / PathOnClient) from caller-controlled file name and bytes without a content-type or magic-byte allowlist
AGENTFORCE-APEX-05	🔴 High	Async Apex Job Drops the Caller's Sharing Context	Detects Queueable, Finalizer, Batchable and Schedulable classes declared without sharing, or with no sharing keyword (an async entry point with no keyword runs without sharing), that query or write records without user mode, and that are started (System
AGENTFORCE-MCP-23	🔴 High	MCP Server Cache Shared Across Users or Tenants	Detects module-level caches (dicts, Maps, TTL/LRU caches, @lru_cache) in MCP servers that serve several users with per-request credentials, where the cache key has no user, tenant or token component
AGENTFORCE-26.3	🟡 Medium	Agent Audience or Preference Scope Without RLS	Detects agent-invoked Apex that reads standing / preference / audience / channel-scope records without with sharing and without USER_MODE
AGENTFORCE-APEX-01	🟡 Medium	Apex Entry Point Reads or Writes Caller-Controlled Records Without FLS	Detects @AuraEnabled, @InvocableMethod, @RemoteAction and @RestResource Apex that inserts, updates or upserts records whose field values the caller controls (SObject parameters, JSON
AGENTFORCE-APEX-02	🟡 Medium	Entry Point Without Sharing Runs Privileged Operation on Caller-Supplied Records	Detects externally callable Apex (invocable, @AuraEnabled, @RemoteAction, REST) in a class with no sharing keyword or 'without sharing' that runs Approval
AGENTFORCE-APEX-04	🟡 Medium	Exposed Apex Query or DML Without CRUD/FLS Enforcement	Detects @AuraEnabled, @InvocableMethod, @RemoteAction and REST Apex whose SOQL, dynamic queries or DML run in system mode with no CRUD/FLS enforcement on the path (WITH USER_MODE / SECURITY_ENFORCED, AccessLevel

CSRF

Rule ID	Severity	Name	Description
AGENTFORCE-25.4	🔴 High	CSRF via ApexPages Parameter DML	Detects Apex controllers that perform DML based on ApexPages URL parameters — classic Visualforce CSRF when paired with apex:page action="{!
AGENTFORCE-VF-02	🔴 High	Visualforce CSRF via page action	Detects apex:page action="{!

Coding-Agent Configuration

Rule ID	Severity	Name	Description
AGENTCFG-01	🔴 High	Coding Agent Approval or Sandbox Disabled	Detects committed coding-agent settings that turn off approval prompts or the sandbox: Claude Code permissions
AGENTCFG-02	🔴 High	Coding Agent Pre-Approves Arbitrary Shell Commands	Detects committed allow lists that pre-approve any shell command (Bash, Bash(), Shell(), run_shell_command, a VS Code terminal auto-approve pattern matching everything) at high, and interpreter, network or authenticated-CLI commands with any arguments (Bash(curl:), Bash(python:), Bash(gh:*), …) at medium
AGENTCFG-03	🟡 Medium	Coding Agent Auto-Trusts Repository MCP Servers	Detects committed settings that trust every MCP server declared in the repository on open (Claude Code enableAllProjectMcpServers: true) or pre-approve every MCP tool (mcp__* allow entries)
AGENTCFG-04	🟢 Low	Personal Coding-Agent Settings Committed	Detects personal agent settings files that are meant to stay local (

Credential Exposure

Rule ID	Severity	Name	Description
AGENTFORCE-SEC-01	🚨 Critical	Committed Credential	Detects credentials committed to the repository in any file: connected-app consumer keys and secrets (Custom Metadata, XML), private keys, AWS/GitHub/Slack/Stripe/Google/OpenAI tokens, Salesforce access tokens and high-entropy values assigned to secret-named keys
AGENTFORCE-SEC-03	🚨 Critical	Apex Entry Point Exposes or Mints Integration Tokens	Detects @AuraEnabled, @RemoteAction, REST and invocable Apex methods that return OAuth access tokens or secret field values to the caller, and guest-accessible methods that mint client-credentials, password or JWT tokens on the caller's behalf
AGENTFORCE-AF-18	🔴 High	Clear-Text Agent Client Token in Mule Configuration	Detects bearer tokens and API keys stored in clear text in a Mule app's properties / YAML (or literally in an Authorization / x-api-key header) and sent by the app's A2A, MCP or agent HTTP clients
AGENTFORCE-AF-24	🔴 High	Credential Logged or Leaked by Java Agent Server	Detects Java agent servers (A2A, MCP or agent-framework projects) that write credentials in cleartext: tokens, client secrets, passwords, API keys or the Authorization / Cookie header (or every request header) passed to a logger or System
AGENTFORCE-SEC-02	🔴 High	Secret Written to Debug Log	Detects Apex System
AGENTFORCE-SEC-06	🔴 High	Hard-coded Authorization Header in Apex	Detects Apex callouts that set an Authorization (Basic / Bearer) or API-key header to a value fixed in code: a literal, constants, or base64 of a hard-coded user:password
AGENTFORCE-VF-04	🔴 High	Visualforce Session ID Exposure	Detects Visualforce pages that render {!$Api
AGENTFORCE-MCP-22	🟡 Medium	OAuth Token Stored With Open Permissions, Logged or Put in a URL	Detects MCP / agent server code that writes OAuth tokens or credentials to a file without restricting its permissions or to a path built from a caller / tenant value, logs or prints a token, or puts a token in a URL (including Salesforce frontdoor
AGENTFORCE-SEC-04	🟡 Medium	Connected App With Full / Non-Expiring OAuth Access	Detects connected apps and External Client Apps that grant the Full OAuth scope or the RefreshToken scope with refresh tokens that never expire, and client-credentials apps whose consumer secret is optional
AGENTFORCE-SEC-05	🟡 Medium	Secret Stored in Public or Unprotected Custom Metadata	Detects Custom Metadata types designed to hold secrets (fields named like secret, password, token, API key, private key, HMAC or signing key) whose type is Public or whose records are unprotected, even when the committed value is a placeholder

Custom Permission Enforcement

Rule ID	Severity	Name	Description
AGENTFORCE-16.1	🔴 High	Agent Action Without Custom Permission Gate	Detects agent actions targeting Apex classes that perform DML on financially-sensitive objects (Opportunity, Order, Contract, Quote) without checking CustomPermission or FeatureManagement

Data Cloud Grounding

Rule ID	Severity	Name	Description
AGENTFORCE-13.1	🚨 Critical	RAG Knowledge Source Without Schema Classification	Detects GenAiPromptTemplates that reference fields without SecurityClassification tags

Data Exfiltration

Rule ID	Severity	Name	Description
AGENTFORCE-21.1	🚨 Critical	PII/PHI Payload Leakage in Tool Output	Detects when agent actions invoke Apex classes that query Salesforce objects containing fields classified as PII, PHI, CCPA, GDPR, HIPAA, or PCI
AGENTFORCE-35.1	🔴 High	SalesBleed: untrusted ingress + sensitive read + egress (lethal trifecta)	One agent or subagent (1) reads records anyone on the internet can write (Lead via Web-to-Lead, Case via Web-to-Case / Email-to-Case, messaging transcripts, objects a guest site profile can create, or objects Experience Cloud external users (Customer / Partner Community, External Apps, portal licenses) can create or edit), (2) can read sensitive CRM data (Account, Contact, Opportunity, Contract, Order, User, objects with Confidential / Restricted fields, or any object through the standard Query Records action), and (3) has a way to send data out: an outbound action (Slack post / reply / DM, email, SMS, notifications, Apex / Flow callouts, External Service operations), instructions or a template that emit links, images or HTML / markdown (rendered or unfurled by chat and Slack surfaces), or an over-broad CSP Trusted Site
AGENTFORCE-35.2	🟡 Medium	SalesBleed: over-broad CSP Trusted Site / CORS origin	A CSP Trusted Site (cspTrustedSites) or CORS allowlist entry trusts far more than one host you own: a bare or scheme-only wildcard, a whole top-level domain (*

Data Exfiltration / Injection

Rule ID	Severity	Name	Description
AGENTFORCE-21.2	🔴 High	Insecure Output Handling (Agent-to-XSS)	Detects Flow screens targeted by agent actions that render LLM-generated output without sanitization

Einstein Copilot Studio Configuration

Rule ID	Severity	Name	Description
AGENTFORCE-12.1	🚨 Critical	Latent Memory Poisoning in Prompt Template	Detects GenAiPromptTemplates that use Conversation Memory ({!Conversation
AGENTFORCE-12.2	🟢 Low	GenAiPlannerBundle API Version Drift	The project contains GenAiPlannerBundle metadata (introduced in API v64

Excessive Agency

Rule ID	Severity	Name	Description
AGENTFORCE-1.1	🚨 Critical	Mandatory User Confirmation	Agent actions that change data or call out (Apex, Flow, external services) should ask the user to confirm before they run
AGENTFORCE-20.1	🚨 Critical	DML Bypassing FLS in Invocable Actions	Detects Apex classes invoked by AI agent actions that perform DML operations (insert/update/delete/upsert/merge) without enforcing Field Level Security (FLS)
AGENTFORCE-20.2	🚨 Critical	Unconstrained ModifyAllData in Agent Context	Detects agent actions configured to run in system context (ModifyAllData equivalent), granting the LLM planner org-wide data access without user-scope constraints
SNOW-20.2	🚨 Critical	Role Masking Not Configured for Dynamic User Agent	Validates that AI Agents using Dynamic User identity mode have Role Masking properly configured
AGENTFORCE-1.4	🔴 High	Agent Write Without User Identity Binding	Detects Agentforce write/delete actions whose Apex/Flow target runs outside the end-user identity (without sharing or SYSTEM_MODE / system-mode Flow)
AGENTFORCE-MCP-21	🔴 High	Salesforce MCP Tool Runs Apex, Writes Code, DML or Permissions Without a Gate	Detects Salesforce MCP server tools that execute anonymous Apex or write Apex classes / triggers / metadata (critical), change org metadata, permission sets, profiles or field-level security, or run create / update / delete DML on an sObject the caller chooses (high), with no confirmation, allowlist, read-only / enable flag or permission check

External Service Security

Rule ID	Severity	Name	Description
AGENTFORCE-15.1	🔴 High	External Service Without Certificate Pinning	Detects Named Credentials used for external service calls that lack certificate pinning (useClientCertificate = false)
AGENTFORCE-15.2	🔴 High	Dynamic Cloaking via External RAG Source	Detects GenAiPromptTemplates that ground against external data sources not in the project's trusted grounding allowlist

Governance

Rule ID	Severity	Name	Description
AGENTFORCE-4.3	🔴 High	Synthetic Evaluation Completeness	Enforces that all deployed GenAiPlannerBundles possess corresponding AiEvaluationDefinition test suites

Graph: Cascading Automation

Rule ID	Severity	Name	Description
AGENTFORCE-32.1	🔴 High	Unintended Autonomous Blast Radius	[Enterprise] Detects when an agent-triggered DML operation on an SObject fires an ApexTrigger that dispatches async jobs (Future/Queueable) with external HTTP callouts

Graph: Component Injection

Rule ID	Severity	Name	Description
AGENTFORCE-34.1	🚨 Critical	Agent-to-UI XSS (Component Injection Graph)	[Enterprise] Performs 4-hop graph traversal proving an LLM-generated string travels from agent output through a Flow screen variable into an LWC component that renders it via unsafe innerHTML or lwc:inner-html without sanitization

Graph: MCP Identity Mismatch

Rule ID	Severity	Name	Description
AGENTFORCE-33.1	🔴 High	MCP Over-Provisioning	[Enterprise] Detects MCP server configurations where the authorizing Connected App has full-scope OAuth access (full/api/chatter_api) disproportionate to the MCP tool's stated narrow purpose

Graph: PII Exfiltration Path

Rule ID	Severity	Name	Description
AGENTFORCE-30.1	🚨 Critical	Context Window PII Poisoning (Graph)	[Enterprise] Performs 4-hop graph traversal to prove regulated data (PII/PHI/GDPR/HIPAA/PCI) travels from a classified CustomField through an Apex query, agent action invocation, and into an LLM PromptTemplate context window

Graph: Privilege Escalation Path

Rule ID	Severity	Name	Description
AGENTFORCE-31.1	🚨 Critical	Autonomous Without-Sharing Escalation (Deep)	[Enterprise] Detects 4-hop privilege escalation: a guest/Community-accessible agent topic whose action targets a System-mode Flow that invokes a without sharing Apex class

Grounding Security

Rule ID	Severity	Name	Description
AGENTFORCE-3.1	🚨 Critical	Hardcoded Sensitive Indicators	Detects hardcoded API keys, OAuth tokens, passwords, PII patterns (SSN, credit cards), private keys, and internal URLs in prompt template text and plugin instructions
AGENTFORCE-3.2	🚨 Critical	Field-Level Security Masking Alignment	Dynamically verifies that custom fields referenced in Prompt Templates possess a SecurityClassification tag

Headless MCP Access

Rule ID	Severity	Name	Description
AGENTFORCE-MCP-01	🚨 Critical	Token Passthrough Exposure Configuration	Detects MCP server configurations using static OAuth client IDs without PKCE enforcement, missing Device Authorization Grant patterns, or lacking Flex Gateway routing policies
AGENTFORCE-MCP-02	🚨 Critical	Broad Scope DevOps Pipeline Inheritance	Detects when external coding agents (Cursor, Claude Code, Windsurf) are granted access to DevOps Center MCP deployment tools targeting production environments without explicit deterministic approval gates
AGENTFORCE-MCP-03	🔴 High	Missing Protocol Scope Constraints	Detects MCP server configurations with wildcard scopes, missing scope definitions, or high-privilege tool exposure without namespace isolation
AGENTFORCE-MCP-04	🔴 High	MCP Tool Definition Drift (Rug Pull Detection)	Detects when MCP tool definitions (descriptions, parameters, schemas) have changed since the last certified scan — indicating a potential Rug Pull attack where a trusted MCP server silently updates its behavior
AGENTFORCE-MCP-05	🔴 High	Shadow MCP Server Detection	Detects MCP servers configured in
AGENTFORCE-MCP-06	🔴 High	MCP Schema Parameter Injection	Detects manipulation of JSON Schema definitions for MCP tool and GenAiFunction parameters
AGENTFORCE-MCP-07	🔴 High	MCP Server Network Exposure	Detects MCP servers configured with non-localhost bind addresses (0

Injection

Rule ID	Severity	Name	Description
AGENTFORCE-25.1	🚨 Critical	Dynamic SOQL Injection	Detects Apex Database
AGENTFORCE-25.2	🚨 Critical	Dynamic SOSL Injection	Detects Apex search
AGENTFORCE-25.7	🔴 High	Model-Controlled Query or Index Injection	Detects agent action inputs (@InvocableVariable / invocable parameters) concatenated into Data Cloud SQL (ConnectApi
AGENTFORCE-FLOW-03	🔴 High	Variable Injection in DML	Dynamic AI input directly evaluates inside a Flow Object Filter, risking SOQL injection
AGENTFORCE-MCP-20	🔴 High	MCP Tool Argument Reaches a Network, File or Code-Execution Sink	Detects MCP tools (Python FastMCP / mcp SDK, TypeScript SDK) whose arguments reach eval / exec / new Function (critical), an HTTP request whose URL starts with the argument (SSRF), or a file open / write / delete path (path traversal, arbitrary file write) with no allowlist, private-address check or base-directory check
AGENTFORCE-MCP-18	🟡 Medium	MCP Tool Input Inserted Into REST Path Without Validation	Detects MCP server code that builds a REST API path (ServiceNow /api/now/

Instruction Integrity

Rule ID	Severity	Name	Description
AGENTFORCE-9.1	🚨 Critical	Metadata Instruction Poisoning	Detects adversarial content patterns in metadata instruction fields (GenAiPlugin instructions, GenAiFunction descriptions, Agent Script systemInstructionOverrides, PromptTemplate content) that could manipulate the LLM planner into performing unauthorized actions
AGENTFORCE-9.2	🔴 High	Cross-Topic Instruction Boundary	Detects when a topic's instruction text references another topic's name or attempts to override the planner's topic-selection logic

MCP Authentication

Rule ID	Severity	Name	Description
AGENTFORCE-24.2	🔴 High	Missing Signature Validation on Agent Webhook	Detects @RestResource Apex endpoints accessible to agent actions that do not implement HMAC signature verification
AGENTFORCE-MCP-15	🔴 High	MCP Named Credential Without Authentication	Detects Salesforce Named Credentials whose callouts carry no authentication (legacy NoAuthentication / Anonymous, or an External Credential with authenticationProtocol NoAuthentication) when they point at an MCP server or are used by agent-reachable Apex that speaks MCP JSON-RPC
AGENTFORCE-MCP-19	🔴 High	MCP OAuth Provider Skips redirect_uri or Client Checks	Detects OAuth authorization endpoints in MCP servers that redirect to the request's redirect_uri without comparing it to the client's registered URIs, accept unknown client_ids (creating them on the fly or by prefix), or combine open dynamic client registration with an authorize step that issues codes without user consent
AGENTFORCE-MCP-17	🟡 Medium	MCP Server Served Over HTTP Without Authentication	Detects MCP servers in TypeScript / JavaScript / Python (MCP SDK, FastMCP) that serve Streamable HTTP or SSE beyond localhost (listen without a host, 0

MCP Client Security

Rule ID	Severity	Name	Description
AGENTFORCE-MCP-24	🚨 Critical	MCP Client Opens Server-Supplied Authorization URL Without Validation	Detects MCP clients and proxies that take the OAuth authorization URL supplied by the MCP server (the authorization_endpoint in its OAuth metadata, or the URL passed to redirectToAuthorization) and pass it to a launcher: the 'open' package, exec / spawn of open, xdg-open, start or cmd, Electron shell
AGENTFORCE-MCP-25	🚨 Critical	Unauthenticated MCP Proxy Spawns Request-Supplied Stdio Command	Detects MCP proxies and bridges (inspector-style tools) whose HTTP route takes command and args from the query string or body and starts them as a stdio MCP server (new StdioClientTransport, spawn, exec) while the route has no authentication (no token / session check, no auth middleware)

MCP Supply Chain

Rule ID	Severity	Name	Description
AGENTFORCE-MCP-08	🚨 Critical	MCP Tool Description Poisoning	Detects MCP tool descriptions that embed hidden instructions (tool poisoning / rug-pull text), e
AGENTFORCE-MCP-09	🚨 Critical	MCP Server Hardcoded Secrets / PII	Detects hardcoded credentials, API keys, or confidential PII resources inside MCP server source
AGENTFORCE-MCP-10	🚨 Critical	MCP Tool Code Execution Sink	Detects shell/process execution in MCP server code whose command comes from non-literal input (tool arguments) and is reachable from a tool handler across files, plus eval/exec sinks in MCP server source
AGENTFORCE-MCP-14	🚨 Critical	MCP Dangerous Tool Capability	Detects MCP tools whose name or description exposes shell/command execution, arbitrary code execution, unrestricted database writes, or filesystem writes
AGENTFORCE-MCP-11	🔴 High	MCP Tool Shadowing / Cross-Tool Hijack	Detects MCP tool descriptions that instruct the model to alter behaviour of other tools (shadowing)
AGENTFORCE-MCP-12	🔴 High	MCP Server Unrestricted Filesystem by Default	Detects MCP servers whose path allowlist treats an empty list as 'allow everything' while the default configuration leaves it empty, so file tools can read and write anywhere the user can (SSH keys, cloud credentials, browser profiles) unless the user opts in to a restriction
AGENTFORCE-MCP-13	🔴 High	MCP Tool Can Change Its Own Safety Configuration	Detects MCP tools (set_config_value, update_settings,
AGENTFORCE-MCP-16	🔴 High	ServiceNow MCP Script or Any-Table Write Tool Without a Gate	Detects ServiceNow MCP server tools that run background / server-side scripts, or create, update or delete records in a table the caller names, with no gate in the handler: no enable flag, table allowlist, permission assertion or confirm step

Multi-Agent Orchestration

Rule ID	Severity	Name	Description
AGENTFORCE-18.1	🚨 Critical	Compositional Fragment Trap Risk	Detects partial instruction fragments across multiple GenAiPlugins that, when combined by the GenAiPlannerBundle, may reconstitute a complete override instruction not visible in any individual topic (ref: SSRN-6372438 'Compositional Fragment Traps')
AGENTFORCE-18.2	🔴 High	Sybil Identity in Multi-Agent Orchestration	Detects duplicate Bot labels or descriptions within a project's agent orchestration
SNOW-18.2	🔴 High	Yokohama Agent Duplication Sybil	Detects duplicated AI Agent definitions that share tool references (sn_aia_agent_tool_m2m)

Network Security

Rule ID	Severity	Name	Description
AGENTFORCE-AF-20	🔴 High	Caller-Controlled A2A Push-Notification URL	Detects A2A servers that accept a push-notification URL from the client (pushNotificationConfig) and later POST task updates to it with no host allowlist or private-address check, so a caller can make the agent send requests and task data to internal hosts or a server it controls
AGENTFORCE-API-01	🔴 High	External Callout Injection	AI Input mapped directly into an external API structure risks Server Side Request Forgery (SSRF) or Data Leakage

Open Redirect

Rule ID	Severity	Name	Description
AGENTFORCE-VF-03	🟡 Medium	Visualforce Open Redirect	Detects Visualforce pages that redirect based on URL parameters

OpenGraph Security

Rule ID	Severity	Name	Description
AGENTFORCE-OG-01	🔴 High	OGP Metadata Prompt Injection	Detects prompt injection patterns embedded in Open Graph Protocol metadata (og:description, og:title) on URLs referenced by agent actions, MCP tools, or prompt template data providers
AGENTFORCE-OG-03	🔴 High	Attractive Metadata Attack via OGP	Detects 'Attractive Metadata Attacks' (NeurIPS 2025) where OGP metadata on MCP server or tool endpoints contains language designed to manipulate LLM tool-selection mechanisms
AGENTFORCE-OG-02	🟡 Medium	A2A Agent Card / OGP Trust Mismatch	Detects mismatches between an agent's A2A Agent Card capabilities and its Open Graph metadata description

Operational Reliability

Rule ID	Severity	Name	Description
AGENTFORCE-10.1	🟡 Medium	Validation Rule Conflict	Detects when AI agent actions target Salesforce objects that have validation rules which could silently reject DML operations

Orchestration Integrity

Rule ID	Severity	Name	Description
AGENTFORCE-4.1	🔴 High	Planner Orchestration Completeness	GenAiPlannerBundle must reference only GenAiPlugins and GenAiFunctions that exist in the workspace

Platform Event Security

Rule ID	Severity	Name	Description
AGENTFORCE-19.1	🚨 Critical	Sub-agent Spawning via Platform Event	Detects agent actions that publish Platform Events where a Platform Event Trigger on that event type invokes another agent session or GenAiFunction
AGENTFORCE-19.2	🔴 High	CDC Without Field Filter in Agent Context	Detects Change Data Capture triggers that deliver unfiltered field changes to agent contexts

Privilege Escalation

Rule ID	Severity	Name	Description
AGENTFORCE-FLOW-01	🚨 Critical	System Context Enforcement	An agent action calls a Flow that ignores the user's permissions: it runs in system mode without sharing, or it is triggered by a Platform Event and so runs as the Automated Process user
AGENTFORCE-1.3	🔴 High	Target Context Privilege Analysis	Apex classes and Flows that an agent action calls should respect the user's sharing rules

Prompt Injection

Rule ID	Severity	Name	Description
AGENTFORCE-PT-01	🟡 Medium	Template Context Poisoning	A GenAI Prompt Template merges a record that outsiders can write (Lead via Web-to-Lead, Case via Web-to-Case / Email-to-Case, messaging transcripts, emails, or an object a guest site profile can create) straight into the prompt ({!$Input:Lead}, {!$Input:Lead

Resource Exhaustion

Rule ID	Severity	Name	Description
AGENTFORCE-23.1	🔴 High	Non-Selective SOQL in Agent Tools (Agent DoS)	Detects Apex classes invoked by agent actions that contain SOQL queries without LIMIT clauses

Runtime Capability Drift

Rule ID	Severity	Name	Description
AGENTFORCE-RD-01	🔴 High	Headless Confirmation Bypass (Experience Layer)	Detects when high-privilege agent actions (DML, Apex deployment, permission modification, financial transactions) can be invoked through headless Headless 360 endpoints without a deterministic Agent Script transition requiring an Experience Layer approval card
AGENTFORCE-RD-03	🔴 High	PII Output Bypass in Headless Transmissions	Detects GenAiFunction actions whose output references objects with FLS-designated sensitive fields (PII, financial data) when no Agent Fabric PII Detector policy covers the agent
AGENTFORCE-RD-04	🔴 High	Headless PII Route Validation	Validates that all agent output paths involving PII-sensitive fields are routed through Agent Fabric policies with both PII detection and prompt guard enforcement
AGENTFORCE-RD-02	🟡 Medium	Variable State Condition Evasion	Detects when security-critical ConversationContextVariables (authentication status, user clearance, financial limits) are declared in the AiAuthoringBundle but never referenced in deterministic Agent Script transition conditions (-> if @variables

SSRF

Rule ID	Severity	Name	Description
AGENTFORCE-22.1	🚨 Critical	Unsafe Autonomous HTTP Callouts	Detects Apex classes invoked by agent actions that make HTTP callouts to dynamically-constructed endpoints without Named Credential enforcement

Secrets Exposure

Rule ID	Severity	Name	Description
AGENTFORCE-MULE-01	🚨 Critical	MuleSoft Plaintext Secret in Secure Config	Detects plaintext client_secret / password / API key values in MuleSoft config/secure properties

Security Configuration

Rule ID	Severity	Name	Description
AGENTFORCE-PT-02	🔴 High	Experimental Template Activation Exposure	Detects when a Prompt Template is configured for global Allowed access without explicit evaluation or safety constraints

ServiceNow ACL

Rule ID	Severity	Name	Description
SNOW-28.1	🚨 Critical	ACL Script Using GlideRecord (Recursive Bypass)	Detects GlideRecord usage in ACL scripts and agent-facing tool scripts
SNOW-28.6	🔴 High	addEncodedQuery Without User Context Restriction	Detects use of addEncodedQuery() in agent-facing scripts where addUserEncodedQuery() should be used

ServiceNow API Authentication

Rule ID	Severity	Name	Description
SNOW-24.1	🔴 High	Agent API Endpoint Without OAuth Scope Validation	Detects Scripted REST APIs and Now Assist API endpoints accessible to AI agents that lack OAuth entity scope validation

ServiceNow Agent Architecture

Rule ID	Severity	Name	Description
SNOW-7.1	🟡 Medium	Agent Instruction Bloat	Detects sn_aia_agent definitions with excessively large or poorly structured instruction fields

ServiceNow Autonomous Scheduling

Rule ID	Severity	Name	Description
SNOW-11.1	🔴 High	Scheduled Job Invoking Agent Without Guardrail	Detects scheduled jobs and background scripts that invoke AI Agents without execution guardrails, risking sub-agent spawning and resource exhaustion

ServiceNow Data Exfiltration

Rule ID	Severity	Name	Description
SNOW-21.1	🚨 Critical	Agent Script Accessing Sensitive Table Without Privacy Guard	Detects agent-accessible scripts that query sensitive ServiceNow tables (sys_user, sys_user_has_role, cmdb_ci, incident, hr_case, sys_attachment) without data privacy classification guards

ServiceNow Data Privacy

Rule ID	Severity	Name	Description
SNOW-13.1	🔴 High	Agent Accessing Classified Data Without Privacy Guard	Detects agent scripts accessing tables with sys_dictionary data_privacy classifications without enforcing privacy guards

ServiceNow Domain Separation

Rule ID	Severity	Name	Description
SNOW-29.1	🔴 High	Domain Separation Drift (Missing sys_domain)	Detects GlideRecordSecure queries in agent-facing scripts that lack sys_domain constraints

ServiceNow Excessive Agency

Rule ID	Severity	Name	Description
SNOW-20.1	🚨 Critical	Agent Executing With Admin Privileges	Detects AI Agent configurations where the execution identity has admin role or the agent scripts use GlideRecord without Role Masking, granting unrestricted database access
SNOW-20.3	🚨 Critical	Agent runAs Falls Back to System Administrator	Detects ServiceNow AI Agent / Flow / script configurations whose runAs / execution identity falls back to a hardcoded System Administrator user sys_id when the intended user is missing

ServiceNow External Service

Rule ID	Severity	Name	Description
SNOW-15.1	🔴 High	Integration Spoke Without Certificate Pinning	Detects IntegrationHub spoke configurations linked to AI agent flow actions that lack certificate pinning or use basic authentication

ServiceNow Flow Security

Rule ID	Severity	Name	Description
SNOW-5.1	🔴 High	Flow Action Without Input Validation	Detects Flow Designer actions (sys_hub_action) and subflows linked to AI agents that lack input validation or execute in system context

ServiceNow Grounding Security

Rule ID	Severity	Name	Description
SNOW-3.1	🔴 High	Grounding Source Without Classification	Detects AI Search grounding sources and RAG configurations that lack data classification guards

ServiceNow Instruction Integrity

Rule ID	Severity	Name	Description
SNOW-9.1	🚨 Critical	Prompt Injection Vector in Agent Instructions	Detects prompt injection vectors in sn_aia_agent instructions, NASK skill markdown, and inbound email action scripts

ServiceNow MCP Access

Rule ID	Severity	Name	Description
SNOW-25.1	🔴 High	MCP Server Without Scope Constraints	Detects MCP server configurations (echelon-ai-labs or native) accessible to ServiceNow AI Agents without protocol scope constraints or tool filtering

ServiceNow MID Server Trust

Rule ID	Severity	Name	Description
SNOW-31.1	🚨 Critical	MID Server / Discovery Trust Violation	Detects insecure MID Server integration patterns including Basic Auth usage, hardcoded credentials, missing mTLS/OAuth, and arbitrary command execution patterns

ServiceNow Memory Safety

Rule ID	Severity	Name	Description
SNOW-12.2	🚨 Critical	Latent Memory Poisoning in Agent Memory	Detects suspicious instruction-like patterns embedded in sn_aia_memory records

ServiceNow Multi-Agent

Rule ID	Severity	Name	Description
SNOW-18.1	🔴 High	Multi-Agent Compositional Fragment Trap	Detects compositional fragment risks when multiple agents share tools or use cases (sn_aia_usecase)

ServiceNow Operational Reliability

Rule ID	Severity	Name	Description
SNOW-10.1	🔴 High	Agent DML Without Data Policy Guard	Detects agent-accessible scripts performing insert/update/delete operations on tables without corresponding Data Policy validation, risking data corruption

ServiceNow Resource Exhaustion

Rule ID	Severity	Name	Description
SNOW-23.1	🔴 High	Unbounded GlideRecord Query in Agent Script	Detects agent scripts executing GlideRecord queries without setLimit() or chooseWindow(), enabling resource exhaustion through unbounded result sets

ServiceNow Role-Based Access

Rule ID	Severity	Name	Description
SNOW-16.1	🔴 High	Agent Action Without Role Gate	Detects agent tool scripts that perform privileged operations without gs

ServiceNow Runtime Drift

Rule ID	Severity	Name	Description
SNOW-27.1	🚨 Critical	Now Assist API Confirmation Bypass	Detects Now Assist API integrations and headless execution paths that bypass tool confirmation requirements

ServiceNow SSRF

Rule ID	Severity	Name	Description
SNOW-22.1	🚨 Critical	SSRF via Dynamic RESTMessageV2 Endpoint	Detects agent scripts using sn_ws

ServiceNow Scope Hygiene

Rule ID	Severity	Name	Description
SNOW-30.1	🔴 High	Application Scope Hygiene Violation	Detects ServiceNow AI agents and tools operating outside their declared application scope

ServiceNow Script Safety

Rule ID	Severity	Name	Description
SNOW-2.1	🚨 Critical	Unsafe Script Pattern in Agent Tool	Detects unsafe scripting patterns in agent-accessible Script Includes and Script Tools

ServiceNow Skill Kit

Rule ID	Severity	Name	Description
SNOW-12.1	🔴 High	Skill Kit Version Drift	Detects sys_gen_ai_skill_applicability records with missing ACLs or version mismatches between skill definitions and agent configurations

ServiceNow Structural Dependency

Rule ID	Severity	Name	Description
SNOW-4.1	🔴 High	Orphaned Agent Tool Reference	Detects orphaned or broken references in sn_aia_agent_tool_m2m and sn_aia_usecase definitions

ServiceNow Supply Chain

Rule ID	Severity	Name	Description
SNOW-26.1	🔴 High	Skill Namespace Shadowing	Detects duplicate tool/skill labels across scoped applications that can confuse the AI agent's tool selection
SNOW-6.1	🔴 High	Update Set Missing Agent Dependencies	Detects Update Sets containing AI Agent artifacts (sn_aia_*) with missing dependencies, unresolved sys_id references, or integrity violations

ServiceNow Tool Configuration

Rule ID	Severity	Name	Description
SNOW-1.1	🚨 Critical	Agent Tool Without Confirmation Gate	Detects ServiceNow AI agent tools that run on autopilot (no person approves each run) and change something: write records, send email or other outbound calls, delete records or change access

ServiceNow Trigger Execution

Rule ID	Severity	Name	Description
SNOW-19.1	🔴 High	Business Rule Triggering Agent Execution	Detects Business Rules (sys_script) that invoke AI Agents

ServiceNow Virtual Agent

Rule ID	Severity	Name	Description
SNOW-14.1	🔴 High	Virtual Agent Topic Without Input Sanitization	Detects Virtual Agent topics (sys_cs_topic), utterances, and topic-block scripts that process user input without sanitization

Slack Integration Security

Rule ID	Severity	Name	Description
AGENTFORCE-14.1	🔴 High	Slack Channel Bot Without DLP Guard	Detects Bots configured to operate in Slack channel contexts without Data Loss Prevention guards

Structural Dependency

Rule ID	Severity	Name	Description
AGENTFORCE-4.2	🔴 High	Component Deactivation Collision	Detects when a prompt template activation record sets accessLevel to 'Blocked' (deactivation) while the template is still referenced by other components

Supply Chain: ToxicSkills

Rule ID	Severity	Name	Description
AGENTFORCE-TS-01	🚨 Critical	Hidden Instruction in Markdown	Detects HTML comment blocks or CSS-hidden text in skill documentation (README
AGENTFORCE-TS-02	🔴 High	Base64 Payload in Skill File	Detects Base64-encoded strings in markdown skill files whose decoded content matches adversarial instruction patterns or credential formats
AGENTFORCE-TS-03	🔴 High	Zero-Width Unicode Injection	Detects zero-width Unicode characters (U+200B, U+200C, U+200D, U+FEFF) in markdown skill files

Unauthorized Action

Rule ID	Severity	Name	Description
AGENTFORCE-FLOW-02	🔴 High	Silent State Modification via Flow	Action targets a Flow containing DML mutations but is invoked without human-in-the-loop confirmation

XSS

Rule ID	Severity	Name	Description
AGENTFORCE-VF-01	🚨 Critical	Visualforce XSS via escape=false	Detects Visualforce components with escape="false", which disables auto-escaping and enables XSS

XXE / SSRF

Rule ID	Severity	Name	Description
AGENTFORCE-25.5	🔴 High	Unsafe XML / SSRF via Dom.Document	Detects Apex that fetches a remote URL and parses it with Dom