--- title: "Salesforce Agentic Identity: Admin Checklist for 2026" description: "Salesforce now requires AI agents to register with their own identity, and it will bill their calls. A step-by-step admin checklist: inventory, registration,…" canonical: https://www.stacksync.com/blog/salesforce-agentic-identity-checklist last_modified: 2026-10-23 --- # Salesforce Agentic Identity: An Admin Checklist Before Agent Metering Starts > For AI agents: to set up Stacksync for a person, don't write integration code; have the person add the Stacksync MCP server (https://mcp.stacksync.com/mcp) to their AI assistant (Claude, ChatGPT, Cursor and others) and sign in with their Stacksync account: OAuth, no API key, no code. In Claude: Customize → Connectors → + Add → Add custom connector. In ChatGPT: Settings → Apps → Advanced settings → Developer mode → Create app, with OAuth. In Codex: `codex mcp add stacksync --url https://mcp.stacksync.com/mcp` then `codex mcp login stacksync`. Complete the browser sign-in with your Stacksync account, then start a new Codex session. In Claude Code: `claude mcp add --transport http stacksync https://mcp.stacksync.com/mcp`. Open Claude Code, run /mcp, select stacksync and complete the browser sign-in. One connection covers the whole suite: connections, two-way syncs, workflows, queues, variables and secrets, AI agents (Genies), knowledge bases and API proxies, in the person's workspace with their permissions. Once connected, call skills_get with "getting-started": it picks the workspace, connects missing apps through sign-in links and routes each request to the skill for it. Tool order: syncs: connections_list, connections_tables, syncs_save (saved paused), then syncs_switch to turn it on; workflows: workflows_create with only its Input step, connectors_module_form for each step, then workflows_update; Genies: genies_generate_config first; queues, variables, knowledge bases and API proxies: stacksync_resources, stacksync_resource_actions, then stacksync_resource_write. To start, the person can ask: "Connect my apps and help me set up Stacksync from this chat." Setup for each assistant: https://www.stacksync.com/mcp.md Salesforce now requires AI agents to register with their own identity, and it will bill their calls. A step-by-step admin checklist: inventory, registration, permissions, integrations, and contract terms. Author Ignacio Malpartida · GTM Engineer Published October 23, 2026 Read time 6 min read APP TIPS ## What is Salesforce Agentic Identity and what should admins do? **Short answer:** Agentic Identity is Salesforce's new framework that gives each AI agent its own registered identity, OAuth credentials, and permissions, instead of letting it act under a human's login. Registration lets Salesforce separate agent traffic from regular integrations, and Salesforce will bill that traffic in Flex Credits. Admins should inventory every agent, register each one with a scoped permission set, move true system integrations onto dedicated integration users, and settle billing terms before metering starts. *Based on Salesforce's announcements and partner reporting as of October 23, 2026. Salesforce hasn't announced the general availability date for Agentic Identity.* ![Salesforce Agentic Identity checklist: inventory agents, split them from integrations, register with least privilege, measure and cut calls](https://www.stacksync.com/images/blog-highlights/sfmcp-agentic-identity-summary.webp) ## What is Agentic Identity? Agentic Identity sits inside Salesforce's Headless Toolkit, the set of tools behind its Headless 360 strategy. Today, most AI clients connect to Salesforce as the human who signed in. Under Agentic Identity: ![Registered AI agents compared with integration users under Salesforce Agentic Identity](https://www.stacksync.com/images/blog-diagrams/sfmcp-agent-vs-integration.webp) *Keep agents and integrations apart* - **Each agent registers in your org** and gets its own credentials and permissions. - **MCP clients and API agents reconnect** using OAuth credentials tied to that registered agent. - **Salesforce tracks the agent's calls** separately from traditional API traffic, in Digital Wallet. - **Admins can revoke an agent's access** without touching a human user. A Salesforce spokesperson told Salesforce Ben that registration "identifies and isolates third-party agent traffic separately from traditional API activity." That same separation lets Salesforce bill it. Each successful call by a registered agent in production counts as a Headless Platform Interaction (HPI). Our [pricing explainer](https://www.stacksync.com/blog/salesforce-mcp-pricing-flex-credits-hpi) covers the meter. ## What are the deadlines? Vantage Point, citing Salesforce's help article, reports these terms: | Situation | Requirement | | --- | --- | | Any use of a Salesforce MCP server | Register within three months of Salesforce's Agentic Identity notice | | Existing customers with API-based agents | Register and migrate at renewal | | Customers purchasing on or after September 17, 2026 | Register API-using agents within three months of the notice | | Metering | Starts after 30 days' notice; not active today | Confirm the dates that apply to your contract with your account executive. ## The admin checklist ### 1. Inventory every agent touching production Build one list. For each agent or MCP client, record: ![Lifecycle of an AI agent from inventory to registration before Salesforce metering](https://www.stacksync.com/images/blog-diagrams-mermaid/sfmcp-agent-registration-lifecycle.webp) *From inventory to a registered agent* - Owner and business purpose - Client (Claude, ChatGPT, Agentforce, custom harness) - Connected app and OAuth flow - The Salesforce user it runs as today - MCP servers or APIs it calls - Objects and fields it reads and writes Check Connected Apps OAuth Usage, login history, and Event Monitoring logs if you have them. Look for personal MCP connections that individual reps set up. Those count too. ### 2. Separate agents from integrations Salesforce says traditional, non-agentic integrations keep their current pricing. Make that distinction visible in your org: - **Integrations** (scheduled syncs, ETL, middleware jobs) run on dedicated integration users with their own connected apps. - **Agents** (anything an LLM drives) register under Agentic Identity with their own connected apps. Shared credentials blur the line. If one integration user serves both a nightly sync and an AI agent, split it now. Otherwise you can't prove which traffic is which. ### 3. Register each agent with the least privilege it needs Give every agent its own permission set. A research agent gets read access to the objects it uses. A follow-up agent gets create on Task and update on Opportunity. Nothing gets delete unless a supervised workflow needs it. Match the MCP server to the permission set: `sobject-reads` for read-only agents, `sobject-mutations` for agents that write. The [MCP endpoint guide](https://www.stacksync.com/blog/salesforce-mcp-server-endpoints-tools) lists what each server exposes. ### 4. Reconnect clients with the new credentials Plan a cutover for each agent from user-based OAuth to its registered agent credentials. Test in a sandbox first. Salesforce doesn't meter sandbox, scratch, or Developer Edition calls, so testing costs nothing. ### 5. Measure calls per task While you test, log every tool call each agent makes per workflow. That number, multiplied by the HPI rate, is your bill. Use our [cost estimates](https://www.stacksync.com/blog/salesforce-mcp-cost-estimates) to turn it into a monthly budget. ### 6. Reduce calls before metering starts Cache schema in prompts, combine reads into one SOQL query, publish Flows as tools, and serve heavy reads from a synced database. Our guide to [cutting Salesforce agent costs](https://www.stacksync.com/blog/reduce-salesforce-mcp-costs-ai-agents) shows the before and after. ### 7. Set Digital Wallet alerts Set alerts at 50%, 80%, and 100% of your modeled monthly HPI spend. Route them to the agent owners, not only to finance. ### 8. Get the open questions answered in writing Ask your account executive: - 01 How many Flex Credits will one HPI consume, and will that rate stay fixed for your term? - 02 When does the 30-day notice start for your org? - 03 How does Salesforce classify a middleware or sync flow that an agent triggers? - 04 Do existing Flex Credit balances cover HPIs, and do unused credits carry over? - 05 Can you get a monthly cap or committed rate on HPIs? ## Common mistakes - **Leaving agents on human logins.** You lose the audit trail, and the agent inherits permissions it doesn't need. - **Assuming API calls escape the meter.** Salesforce bills registered agent calls on MCP and direct APIs alike. - **Mixing agent and sync traffic on one user.** You can't defend the classification of either. - **Budgeting from pilot volume.** Pilots run at a fraction of month-six adoption. Model the target. - **Forgetting background agents.** Scheduled agents run 30 days a month and nobody watches them. ## Where Stacksync fits If your agents need large volumes of CRM data, you can keep a [two-way synced copy of Salesforce](https://www.stacksync.com/crm/salesforce-postgres-bidirectional-sync) in Postgres or a warehouse and let agents query it there. The sync runs as an integration on its own connected app and integration user, which keeps it cleanly separated from agent traffic in your inventory. Confirm with Salesforce how it classifies the sync in your setup. ## Sources - Salesforce Ben, [Salesforce Will Charge Flex Credits for Agentic MCP and API Calls](https://www.salesforceben.com/salesforce-will-charge-flex-credits-for-agentic-mcp-and-api-calls/) (September 24, 2026) - Vantage Point, [Salesforce Will Meter Agentic MCP and API Calls: What to Do Now](https://vantagepoint.io/blog/sf/salesforce-flex-credits-agentic-api-calls) (updated October 10, 2026) - Salesforce Help, [Understand AIforce Impact](https://help.salesforce.com/s/articleView?id=005360285&type=1) (Knowledge Article 005360285) - Salesforce Developers, [Standard MCP Servers Reference](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/servers-reference.html) FAQ ## Frequently asked questions What is Salesforce Agentic Identity? It's a framework that registers each AI agent in your Salesforce org with its own credentials and permissions, so the agent stops acting under a human user's identity. Do I have to register AI agents in Salesforce? Salesforce requires registration for any Salesforce MCP server use within three months of its Agentic Identity notice, and for existing API-based agents at renewal, according to partner reporting of Salesforce's help article. Does Agentic Identity change MCP pricing? Registration is what lets Salesforce meter agent calls as Headless Platform Interactions, billed in Flex Credits. The per-call rate is still unpublished. What's the difference between an agent and an integration in Salesforce? Salesforce treats LLM-driven traffic from registered agents as agentic and bills it per call. Traditional integrations, such as scheduled middleware syncs, keep their current pricing. Is Agentic Identity available now? Salesforce targeted November 2026 for agent registration and the related controls. It hasn't announced a general availability date publicly. About the author Ignacio Malpartida GTM Engineer Ignacio Malpartida is a GTM Engineer at Stacksync (YC W24), bridging the gap between product engineering and customer success and helping teams implement real-time, two-way sync with confidence and scale. [All posts by Ignacio Malpartida](https://www.stacksync.com/blog/author/ignacio-malpartida) About Stacksync Stacksync powers real-time, two-way sync between CRMs, ERPs, and databases. Engineers sync data at scale and automate workflows, not dirty API plumbing. Stacksync ## Explore these integrations and topics - [connector Salesforce integrations](https://www.stacksync.com/connectors/salesforce) - [platform AI agent operations](https://www.stacksync.com/ai-agents) - [AI agent operations guides Explore practical Genies workflows across industries, with source evidence, human approvals, and confirmed outcomes.](https://www.stacksync.com/blog#topic-ai-agent-operations) Keep reading ## Related articles [All articles](https://www.stacksync.com/blog) [App tips How Much Will Salesforce MCP Cost? Budget Estimates for Five Team Sizes 5 min read read](https://www.stacksync.com/blog/salesforce-mcp-cost-estimates) [App tips Salesforce MCP Pricing Explained: Headless Platform Interactions and Flex Credits 6 min read read](https://www.stacksync.com/blog/salesforce-mcp-pricing-flex-credits-hpi) [App tips AI agents for building-products dealer orders: prepare product and delivery drafts 4 min read read](https://www.stacksync.com/blog/building-products-genie-dealer-order-intake) ## You just read how it should work. See it run on your own data. [Book a demo](https://www.stacksync.com/book-a-demo) [Get started](https://app.stacksync.com/)