{ "id": "salesforce", "name": "Salesforce (Agentforce 360 + Data 360 + Customer 360)", "subtitle": "Mapped to the 4+1 Layer AI Infrastructure Model", "version": "v1.0 - Initial Assessment", "date": "July 17, 2026", "source": "Salesforce Developer docs (Agentforce Trust Layer, Supported Models, Data 360 architecture and security, search index and retriever guides), MuleSoft Agent Fabric documentation, Salesforce Architect fundamentals (Data 360, MuleSoft Agent Fabric deep dive), Salesforce and Informatica press releases (Informatica acquisition close Nov 18 2025; 'Informatica from Salesforce' data-foundation announcement May 20 2026), Agentforce 360 GA (Spring '26, Feb 23 2026), Agentforce Observability GA (Feb 2026), AWS Big Data blog (zero-copy access to Iceberg from Data 360 via Glue REST catalog), Salesforce FY26 metrics (Q3/Q4 Data Cloud and Agentforce), published 4+1 model. Informatica folded into this row on the whose-paper rule (wholly owned since Nov 2025). Determinism distinction ('you can't prompt your way to deterministic output' / 'legal is not right') written at 2C as a universal finding and adopted as a 2C scoring-discipline rule (ratified Salesforce v1.0, sibling of 'routing is not reasoning'), applied uniformly rather than as a Salesforce-only downgrade.", "status": "complete", "summary": { "title": "Summary Finding", "paragraphs": [ "Salesforce is an enterprise application, agent, and data platform that floats above Layer 0 and is strong everywhere it has always lived: the data plane of storage and governance, retrieval, and movement, plus the agent runtime and the value plane. It moderates at the two layers it does not truly own. Infrastructure orchestration, where it manages its own workloads on rented cloud. And the reasoning plane, where it governs and enforces but does not reason. Authority sits in Salesforce's opinion layer wherever Salesforce ships one, which is nearly everywhere above the silicon.", "Salesforce is the one row on the instrument that runs both capture mechanisms at full strength, and they point in opposite directions. The value plane is the deepest coupled, visible capture in enterprise software: your business runs in Salesforce's namespace, decades deep, and no one is confused about the commitment. Zero-copy federation is the decoupled, invisible ask laid over it. Your bytes stay in Snowflake, the openness is real, and the opinions you accumulate on top are entirely Salesforce's. The coupled pole is honest. The decoupled pole underprices the commitment, because the data portability is a decoy and the dependence lives one layer up.", "The platform's answer to control is deterministic guardrails, not deterministic validation. Validation rules, before-save Apex, and approval processes let a human programmatically bound what an agent may commit, and that commit-boundary machinery is more than most platforms give you. It checks whether the result is legal, not whether it is right. The controls Salesforce offers for rightness are prompt-shaped: grounding, instructions, Agent Script, the reflection step. You cannot prompt your way to deterministic output. So rightness stays probabilistic, and the deterministic validator is the seam the enterprise builds itself, on a reasoning core it cannot inspect.", "The reasoning plane is real governance without a reasoning mechanism. MuleSoft Agent Fabric governs agents across platforms, including agents built outside Salesforce, and the sharing model enforces agent access live. All of it enforces policy the enterprise authored statically. None of it places inference or validates an outcome dynamically. The Informatica acquisition, closed November 2025, gives Salesforce arguably the richest data-provenance telemetry on the instrument: lineage, catalog, quality, and mastered entities. There is no 2C engine that consumes it to decide anything. The vendor with the best inputs to a reasoning plane still ships no plane that reasons over them. That is the Dell finding restated, and Salesforce makes it sharper.", "Of 31 scored components, 29 are Ceded, two are Delegated, and none are Retained. That is a more captive profile than Databricks, because Salesforce has fewer open substrates to stand on. The two open surfaces are the Iceberg federation interface and the AppExchange ecosystem. The buyer gets the most complete customer-engagement AI stack in enterprise software, agents that execute real business work under mature commit-boundary governance, and near-zero dependence on NVIDIA. In exchange they cede nearly every opinion layer Salesforce ships: the apps, the data model, the governance, the pipelines, the retrieval, the runtime, and the agents. What stays the enterprise's is the reasoning plane Salesforce declined to close. It hands you the inputs for deterministic validation and live placement, and leaves you to build both." ] }, "layers": [ { "id": "layer0", "label": "Layer 0", "shortName": "Compute", "title": "Compute & Network Fabric", "purpose": "Raw compute, networking, and acceleration fabric", "status": "gap", "statusLabel": "Not Salesforce's Layer (By Design)", "nvidia": [ { "component": "No NVIDIA Surface at Layer 0", "detail": "Salesforce designs no silicon, networking, or acceleration fabric, and consumes no NVIDIA platform here. The AI-compute question is delegated wholly to the hyperscalers and to model providers through the LLM Gateway. The near-zero NVIDIA column starts here and holds across the row." } ], "gap": "Layer 0 is not Salesforce's layer, and that is the pitch: the buyer never thinks about silicon. Hyperforce delivers the platform as infrastructure-as-code onto AWS, Google Cloud, Azure, and Alibaba, each region across three or more availability zones, and the buyer's only real Layer 0 decision is data residency. Agentforce 360 arrives with no infrastructure to stand up.\n\nSalesforce still operates first-party data centers for non-Hyperforce orgs, and it genuinely runs infrastructure, but that does not move the cell. The exposure test (ratified CoreWeave 1C vs. Supermicro 1C) governs: an underlay capability the vendor does not surface as a purchasable, customer-administered product is not that vendor's capability. Salesforce's compute sits invisibly behind a SaaS interface with no customer-administered surface, the same reasoning that scores a cloud's invisible internal engine as gap at the layer it silently occupies.\n\nThe consequence for the 4+1 model matches Databricks, Palantir, and Qlik: a Salesforce adoption decision resolves no Layer 0 authority question. Whatever capture exists at silicon and fabric belongs to the hyperscaler underneath, a different row on this map.", "borrowedJudgment": "Total at Layer 0, and irrelevant to the value proposition by design. Salesforce inherits all silicon, networking, and acceleration judgment from the host environment. The enterprise's Layer 0 authority position is set by a vendor it did not choose in the Salesforce transaction, and the docs do not hand it that choice.", "notes": "Heroku is Salesforce-owned and sells customer-administered compute (dynos) plus Heroku AI (Managed Inference and Agents, GA), but it does not move this cell. Heroku entered a 'sustaining engineering' mode in February 2026 (stability only, no new features, no new Enterprise Account contracts), and its inference product is PaaS on rented cloud IaaS, not silicon or fabric. It stays off Layer 0 for the same reason Databricks' classic-clusters-in-your-VPC do. Nothing here is scored.", "components": [] }, { "id": "layer1a", "label": "Layer 1A", "shortName": "Storage", "title": "Data Storage & Governance", "purpose": "Durable, governed data foundation — the Governance Catalog that Layer 2C queries", "status": "strong", "statusLabel": "Authorization Authority, Dual Capture", "nvidia": [ { "component": "No NVIDIA Layer 1A Dependency", "detail": "The object model, Data 360 governance, zero-copy federation, and the Informatica catalog and mastering stack are Salesforce IP or open-standard interfaces. NVIDIA contributes nothing to the governance layer." } ], "gap": "This is the layer Salesforce has been rebuilding the company around. The buyer gets the CRM object model they already run their business on, Data 360 unifying customer data across the estate, and zero-copy federation that reaches into Snowflake, Databricks, BigQuery, Redshift, and generic Iceberg catalogs without moving a byte. Q3 FY26: 32 trillion records ingested in a quarter, 15 trillion through zero-copy connectors, up 341% year over year, with federation at roughly a 28x cost reduction against batch. On top sits Informatica's master data management, catalog, and lineage.\n\nThe deciding line is the one that separated Databricks and Palantir (strong) from Qlik (moderate): is the governance an authorization authority or merely curation and quality metadata? Qlik's was curation, with access enforcement delegated to AWS IAM, and that held it at moderate. Salesforce is unambiguously an authorization authority. Data 360 Governance authors fine-grained field-, object-, and record-level policies enforced at runtime, consistently across Agentforce, analytics, and segmentation, with dynamic masking embedded in the semantic definitions. That is Unity Catalog's structural property and the Ontology's, reached through the most battle-tested sharing model in enterprise software.\n\nRule 4 (general vs. fixed-function) is the honest pressure point. On its own, Data 360 is CRM-shaped. Informatica is what dissolves the concern: general-purpose data management across products, finance, and suppliers, hybrid, multicloud, and on-prem, credited in full on the whose-paper rule. This cell is strong because Salesforce bought its way to data-plane generality in November 2025; without Informatica it would read moderate.\n\nFrontier check (rule 6): runtime authorization authority extending to agents, genuine multi-vendor open federation at scale, and a top-tier catalog, lineage, and mastering stack stands with Databricks and Palantir at the current frontier.", "borrowedJudgment": "Low for the governance logic, which is Salesforce IP and Ceded to Salesforce. The zero-copy federation interface is Delegated: a genuine multi-vendor Iceberg REST standard with the tables in the customer's own account. The row's signature is that both capture mechanisms run at once here. The CRM core is coupled and visible; zero-copy is decoupled and invisible, the purest expression of 'data portability is a decoy' on the instrument, because the bytes stay in Snowflake while the access policies, harmonization, and agent grounding accumulate entirely in Salesforce.", "notes": "Whose-paper rule folds Informatica (wholly owned since Nov 18 2025) into this row at full credit. Watch-list (not scored): Agentic Multidomain MDM ('industry's first,' Informatica World, May 2026) reads as announcement language; the Data 360 Connector and Scanner for real-time bidirectional flow with end-to-end lineage (announced May 20 2026) is GA-unconfirmed in docs. Fact question pending: how deeply Informatica is deployed as an integrated Salesforce capability today versus a co-owned but separate platform. Does not change the whose-paper credit; changes only how the cell narrates. Instrument follow-up (Keith's ruling): whether Informatica warrants a separate standalone row.", "components": [ { "component": "Core Object Model & Sharing Model", "detail": "The CRM data model plus object-, field-, and record-level security, sharing rules, permission sets, and profiles. The deepest coupled capture surface in the row: decades of accumulated sharing logic that lifts nowhere. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Data 360 (DMOs, Harmonization, Data Spaces)", "detail": "Unifies customer data into a proprietary data model with harmonization and data-space governance boundaries. The harmonization opinions do not lift. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Data 360 Governance (Fine-Grained Policies + Dynamic Masking)", "detail": "The authorization authority itself: field/object/record policies and dynamic masking embedded in the semantic layer, enforced at runtime across Agentforce, analytics, and segmentation. Policies are authored in Salesforce's engine and portable nowhere. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Zero Copy Federation (Iceberg REST → Snowflake / Databricks / BigQuery / Redshift / S3)", "detail": "Federates external Iceberg tables through the AWS Glue Iceberg REST endpoint and equivalent catalogs, reading Parquet directly via the Hyper engine without moving data. The consumed interface is a genuine multi-vendor standard and the tables stay in the customer's own account, so the data-layer opinions lift. Delegated, matching Qlik Open Lakehouse and Databricks open lakehouse storage.", "dapm": "Delegated" }, { "component": "Informatica (MDM + Data Catalog + Data Lineage)", "detail": "Master data management, catalog, and end-to-end lineage, now sold as 'Informatica from Salesforce' and integrated with Data 360. General-purpose data management credited at full weight on the whose-paper rule. Master data models and lineage graphs are proprietary and do not lift. Proprietary platform, now first-party, no open exit.", "dapm": "Ceded" }, { "component": "Salesforce Shield (Platform Encryption, Event Monitoring, Field Audit Trail)", "detail": "Security implementation captive to the platform: encryption schemes, monitoring, and audit configurations do not lift to another vendor's storage. Matches Dell's built-in cyber resilience. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer1b", "label": "Layer 1B", "shortName": "Retrieval", "title": "Context Management & Retrieval", "purpose": "Low-latency retrieval for RAG — vector/hybrid search, context windows", "status": "strong", "statusLabel": "Governed Retrieval — Native Infrastructure Surface", "nvidia": [ { "component": "No NVIDIA Layer 1B Dependency", "detail": "The vector database, hybrid search, custom retrievers, and Atlas retrieval reasoning are Salesforce IP. Any GPU serving the embedding models belongs to a provider's row, not Salesforce's." } ], "gap": "RAG with no retrieval infrastructure to build. Data 360's vector database is GA, with hybrid indexes blending semantic and keyword retrieval into a Vector Data Model Object. Customers tune parsing and chunking to their content formats, select an embedding model sized to their chunk length, and define custom retrievers that scope exactly what an agent pulls. Intelligent Context (GA February 2026) adds a workspace to refine unstructured extraction with natural-language instructions before an index is committed. Atlas performs query refinement and advanced retrieval, then assesses the quality of its own response.\n\nThe Qlik moderate was retrieval-as-product-feature rather than retrieval-as-infrastructure, decided on three absences: no index management, no embedding choice, no retrieval API the enterprise's own applications can consume. Salesforce has all three, which puts it in the Databricks shape: GA native vector plus hybrid search, configurable indexes, managed embedding selection, and permission-aware retrieval by construction rather than by bolt-on filter. Permission-inheriting retrieval is the structural property that earned Databricks, Palantir, and VAST strong at this layer; Salesforce reaches it through the sharing model.\n\nFrontier check (rule 6): GA native retrieval, structural permission inheritance, a configurable infrastructure surface, and retrieval-quality observability through Agentforce Observability stands with the 1B frontier and well above the Dell/VMware/Nutanix moderate cohort, whose retrieval is Delegated to Elastic or pgvector.", "borrowedJudgment": "Low. Indexes, chunking strategy, the VDMO format, retriever definitions, and the embedding models are all Salesforce's and Ceded to Salesforce. The expensive-to-rebuild part is not the vectors but the permission inheritance: leaving means re-deriving decades of object-, field-, and record-level sharing semantics in a system that has never heard of them.", "notes": "Embedding choice appears to be selection from Salesforce's own catalog (e.g., Salesforce Embedding V2 Small) rather than bring-your-own-embedding, a texture difference from Databricks that does not move the grade. The Atlas planner and execution half is scored at 2B, not double-counted here (Dell precedent: retrieval at 1B, movement at 1C). Fact question that could pull this toward moderate: can Data 360 retrieval target a third-party embedding model, and can non-Agentforce applications call retrievers through a documented API, or are retrievers only consumable from prompt templates and Agentforce?", "components": [ { "component": "Data 360 Vector Database + Hybrid Search (VDMO)", "detail": "GA. Vector and hybrid (semantic + keyword) search over chunked, embedded content in a Vector Data Model Object, permission-aware by construction. The index format, chunking, and retrieval engine are proprietary; the permission inheritance is the part that does not rebuild cheaply. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Custom Retrievers", "detail": "Customer-defined retrievers that scope how, where, and what an agent pulls, each bound to one search index. Retriever definitions are Salesforce-specific and run only here. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Intelligent Context", "detail": "GA February 2026. A workspace to refine unstructured-data extraction with prompt-based instructions before building an index. The tuning opinions are captive. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Atlas Advanced RAG (Query Refinement + Self-Assessed Quality)", "detail": "Query expansion, advanced retrieval, and self-assessment of response quality inside the reasoning engine. Proprietary retrieval reasoning; the planner and execution half of Atlas is scored at 2B, not double-counted. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer1c", "label": "Layer 1C", "shortName": "Pipelines", "title": "Data Movement & Pipelines", "purpose": "Move/transform data — ETL/ELT, lineage, cost-aware movement, KV cache tiering", "status": "strong", "statusLabel": "MuleSoft + Informatica — Heterogeneous Movement", "nvidia": [ { "component": "No NVIDIA Layer 1C Dependency", "detail": "Pipelines run on CPU compute across MuleSoft and Informatica. No acceleration dependency at the movement layer." } ], "gap": "Salesforce owns two category-leading movement platforms outright. MuleSoft Anypoint delivers API-led integration, the Mule runtime, DataWeave transformation, and a large connector estate, long-GA and deeply deployed. Informatica brings the incumbent enterprise ETL/ELT stack: Cloud Data Integration, mass ingestion, log-based change data capture, and the PowerCenter install base, running hybrid, multicloud, and on-prem. Data 360 adds its own batch and streaming ingestion, and the zero-copy path scored at 1A means the cheapest movement is often no movement at all.\n\nQlik earned strong here on Attunity CDC plus Talend plus Upsolver, with the reasoning that different centers (in-platform transformation vs. heterogeneous movement) can sit at the same altitude. Salesforce occupies Qlik's exact center with more of it: Informatica is the incumbent Talend spent a decade competing against, and MuleSoft adds API-led integration Qlik has no answer to. Peer to Databricks and Qlik (strong), above Palantir and Dell (moderate). This is not momentum from the adjacent strongs; it is strong on either owned asset alone.\n\nThe honest limit matches Palantir's 1C: the layer's purpose line includes KV cache tiering, and Salesforce has nothing there, because it does not operate at the storage-physics layer. Where Dell moves bytes between storage and the GPU cluster, Salesforce moves and governs records between systems that were never designed to talk. The general movement function is covered comprehensively; the storage-physics slice is simply not Salesforce's layer.", "borrowedJudgment": "Low. The movement IP is Salesforce-owned (MuleSoft and Informatica acquisitions). Decoupled pattern: pipelines are structurally pass-through, so the data lands open in someone else's system, while the accumulated opinions (Mule flows, DataWeave, Informatica mappings and CDC task definitions, connector configs) stay captive in proprietary frameworks. For a large Informatica shop the lift to leave is a multi-year rebuild on Fivetran, Debezium, dbt, or Airflow, scaling with task count.", "notes": "Watch-list (not scored): the Data 360 Connector and Scanner for real-time bidirectional flow (announced May 20 2026), GA-unconfirmed in docs. Informatica's IDMC framing bundles movement and governance; the split across 1C and 1A is the instrument's, following the Dell precedent that splits AIDP across 1B and 1C. Fact question: does the Mule community runtime give a customer real operational independence from Anypoint, or is the platform the only production path (read as the latter, hence Ceded rather than Delegated)?", "components": [ { "component": "MuleSoft Anypoint Platform (Mule Runtime, DataWeave, Connectors)", "detail": "API-led integration, the Mule runtime, the DataWeave transformation language, and a large connector estate. DataWeave is proprietary and Mule flows lift nowhere; a community runtime exists but Anypoint, where the opinions live, is proprietary. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Informatica Cloud Data Integration + CDC + Mass Ingestion", "detail": "The incumbent enterprise ETL/ELT, change data capture, and mass ingestion stack, now first-party. Mappings and CDC task definitions are captive; competitors exist but nothing lifts without rebuilding. Proprietary platform, no open exit.", "dapm": "Ceded" }, { "component": "Data 360 Ingestion (Data Streams, Batch + Streaming Connectors)", "detail": "Native ingestion into the Data 360 model across batch and streaming sources. Proprietary managed ingestion into a proprietary data model. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "MuleSoft Flex Gateway / API Manager", "detail": "API policy management and gateway enforcement across the integration estate. Policies and gateway configuration are Salesforce-specific. Named here for the integration function; its agent-governance evolution (the Omni Gateway) is scored at 2C, not double-counted. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer2a", "label": "Layer 2A", "shortName": "Orchestration", "title": "Infrastructure Orchestration", "purpose": "GPU scheduling, quotas, RBAC, fair-share scheduling, utilization optimization", "status": "moderate", "statusLabel": "Managed Orchestration; No GPU Plane", "nvidia": [ { "component": "No GPU Plane to Depend On", "detail": "Layer 2A is where NVIDIA dependency concentrates for most of the map (Run:ai, GPU operators, scheduling), and Salesforce has no GPU plane to be dependent in. The AI-compute question is delegated wholly to model providers through the LLM Gateway." } ], "gap": "There is nothing to operate, and that is the offer. Hyperforce provisions everything invisibly. CloudHub 2.0 runs Mule applications on isolated Amazon EKS clusters per region, managed entirely by Salesforce. For regulated workloads, Anypoint Runtime Fabric deploys Mule runtimes onto Kubernetes the customer creates and manages (EKS, AKS, GKE, OpenShift), isolating each application with automated failover and horizontal scaling. The buyer gets deployment orchestration across a hybrid estate without building a control plane.\n\nCalibration lands moderate, in the Qlik/Palantir/Databricks cohort by their exact logic: orchestration exists, the vendor holds it, and it is scoped to the vendor's own workloads. Not gap: the real-dependence guardrail decides it, the way it decided Qlik. Runtime Fabric runs Mule runtimes on the customer's own Kubernetes clusters, on the customer's bill, under a Salesforce control plane, which is more than Qlik's single Spot cluster type earned. Not strong: VMware and Nutanix are strong here because they orchestrate all infrastructure; Salesforce orchestrates Salesforce.\n\nQuotas and fair-share are in this layer's purpose line, and Salesforce enforces both through the most absolute exercise of 2A authority on the instrument: multi-tenant governor limits, imposed rather than configured, with the AI-era version metered as Einstein Requests and Agentforce Flex Credits. The buyer does not configure this. They consume it.", "borrowedJudgment": "Moderate and Ceded, and the load-bearing consequence is traceability. The enterprise inherits an unconfigurable substrate, and because the infrastructure is a turnkey black box it cannot answer substrate-level decision provenance: which model instance, in which region, at what cost or compliance tier served a given inference. That is the Infrastructure-2C gap seen from below, and it is the honest cost of the turnkey posture. Governor limits and Flex Credits are the visible edge of that authority; the invisible part is that you cannot audit what you cannot configure.", "notes": "Heroku is named with its gate (sustaining-engineering mode since February 2026, Enterprise contracts closed to new customers) and not scored; under rule 5 that gate keeps a real capability from carrying the cell. Fact question: does Salesforce expose any AI capacity-allocation surface beyond commercial metering (allocate Einstein Requests or Flex Credits across business units, per-agent spend caps, reserved capacity)? If yes, that is a thin quota surface worth scoring and it also touches 2C; if purely billing, the prose framing stands.", "components": [ { "component": "Hyperforce + CloudHub 2.0 Managed Compute", "detail": "Infrastructure-as-code provisioning on public cloud, and fully managed Mule execution on isolated per-region EKS clusters. Invisible managed orchestration the customer never configures. Present-and-Ceded, per the cloud and Palantir convention. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Anypoint Runtime Fabric (Mule Control Plane on Customer Kubernetes)", "detail": "Deploys Mule runtimes onto the customer's own Kubernetes clusters under a Salesforce control plane. The Run:ai precedent applies: a proprietary control plane whose opinions live in Runtime Manager rather than portable Kubernetes manifests, Ceded even though it sits on Kubernetes. The customer's own cluster underneath is a different vendor's row, not Salesforce capability. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Governor Limits + Einstein Requests / Flex Credits", "detail": "Multi-tenant resource quotas and fair-share, plus AI-consumption metering. Resource-allocation authority held absolutely by the vendor and imposed on the customer, with no configuration surface. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer2b", "label": "Layer 2B", "shortName": "Runtime", "title": "Application Runtime & Execution", "purpose": "Model serving, agent execution, inference APIs, distributed inference", "status": "strong", "statusLabel": "Atlas Runtime — Governed, Constructible, Any-Model", "nvidia": [ { "component": "NVIDIA Nemotron Models (Beta)", "detail": "NVIDIA Nemotron (Nano/Super) appears in the supported-models list in Beta, the only NVIDIA surface in the entire row and an optional model choice rather than a structural dependency. Watch-list, not scored. The reasoning core is otherwise a frontier LLM served by OpenAI, Anthropic (via Bedrock), Google, or a bring-your-own provider through the LLM Gateway." } ], "gap": "This is what the buyer came for in 2026, and it is a genuine first-party runtime, not a wrapper. The Atlas Reasoning Engine (GA) is Salesforce's own agent runtime: a planner that decomposes goals, an action selector, a tool-execution engine, a memory module, and a reflection step. Agents are constructed, not just configured: Agentforce Builder for conversational build-test-deploy, Agent Script for deterministic control flow, and pro-code Apex underneath. Model access is real and open: Salesforce Default (a managed GPT-4o mix), AWS-hosted Claude, and BYOLLM GA across Bedrock, Azure OpenAI, OpenAI, and Vertex, plus the LLM Open Connector for custom or open-source models. Every call routes through the Einstein Trust Layer. Agentforce Voice adds real-time execution. And the execution target is distinctive: agents invoke Flows and Apex, so the runtime executes deterministic business logic, not just API calls.\n\nThe deciding precedent is Palantir, which went strong at 2B without model serving or foundation training. Palantir's strong rested on a governed, constructible, any-model agent runtime: the stateful loop, isolation, swappable model, evaluation, observability. Salesforce has the identical shape feature for feature, and adds a mature deterministic execution substrate (Flow/Apex) with commit-boundary enforcement. On the line that separated Palantir (strong) from Qlik (moderate), constructible governed runtime with swappable model versus configurable agents with a fixed model, Salesforce is unambiguously on the Palantir side.\n\nFrontier check (rule 6): peer to Palantir and Databricks. The one thinness is general model serving: Databricks sells OpenAI-compatible serving as infrastructure, while Salesforce's gateway feeds its own agents. That is why this is a clean strong and not a category-leading one.", "borrowedJudgment": "Low for the runtime, governance, and execution machinery, all Salesforce IP and Ceded to Salesforce. The reasoning core is explicitly borrowed and explicitly swappable (BYOLLM), the Palantir pattern rather than the Qlik one. The honest addition, stated as a universal property rather than a Salesforce charge: the runtime governs how agents act and deterministically enforces what commits, but the correctness of the reasoning is inherited from a probabilistic model and is not deterministically validated. That gap is noted at 2C as universal, not penalized here.", "notes": "Watch-list (Beta, not scored): NVIDIA Nemotron models. Fact question (rule 4, general vs. fixed-function): can Agentforce agents run meaningfully outside the Salesforce operating context as a general runtime (the Slack and Agentforce-in-ChatGPT surfaces suggest partly yes), or is the runtime effectively bound to acting on Salesforce objects? Read as general enough for strong given Apex, MCP, and MuleSoft tool reach; a hard boundary here is the one thing that could pull it to moderate.", "components": [ { "component": "Atlas Reasoning Engine (Agent Runtime)", "detail": "GA. Proprietary planner, action selector, tool-execution engine, memory, and reflection loop. Agents built on it do not lift. Matches the Palantir AIP runtime. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Agentforce Builder + Agent Script", "detail": "GA (Spring '26). Conversational build-test-deploy plus a human-readable expression language for deterministic control flow and guided tool use. Agent definitions and scripts are Salesforce-specific. The determinism is real only where the script hands off to Flow or Apex; the model's job inside a step stays probabilistic. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Model Access (LLM Gateway / BYOLLM / LLM Open Connector)", "detail": "GA. Governed access to Salesforce Default (GPT-4o mix), AWS-hosted Claude, and bring-your-own models across Bedrock, Azure OpenAI, OpenAI, and Vertex, plus custom/open-source via the Open Connector. Model choice is portable; the gateway and Trust Layer integration are captive. Matches the Palantir Model Catalog (swappable model, captive governed access). Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Flow + Apex Action Execution", "detail": "The deterministic execution substrate the agent invokes: Flows and Apex classes run the same way every time and enforce logic at the commit boundary. Real deterministic-code-in-the-loop, and proprietary at once: Apex runs only on Salesforce and Flows lift nowhere. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Einstein Trust Layer", "detail": "The governed inference path: masking, grounding, toxicity detection, and audit logging around every model call. A proprietary constraint layer that shapes behavior by instruction and policy, not a deterministic outcome validator. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer2c", "label": "Layer 2C", "shortName": "Reasoning", "title": "Agentic Infrastructure — The Reasoning Plane", "purpose": "Policy-driven placement and resource coordination — the Autonomy Layer", "status": "moderate", "statusLabel": "Governance Without a Reasoning Mechanism", "nvidia": [ { "component": "No NVIDIA Layer 2C Dependency", "detail": "The governance plane (Agent Fabric, the Trust Layer, Observability, runtime permission inheritance) is entirely Salesforce IP. NVIDIA controls no identity, governance, or routing here." } ], "gap": "Salesforce ships one of the deepest agent-governance surfaces on the map, and MuleSoft Agent Fabric (GA) is the reason. It is a multi-component agent control plane: an Agent Registry cataloging agents, tools, and MCP/A2A servers; an Agent Broker routing tasks across A2A-compliant agents; Agent Governance (the Omni/Flex Gateway) enforcing auth, rate limits, token and cost caps, tool-access restrictions, and audit logging on every interaction; and an Agent Visualizer. Its distinctive property is cross-platform reach: it governs agents built outside Salesforce (Bedrock, Vertex, Copilot Studio), not just Agentforce agents. Add Agentforce Observability (GA February 2026), the Trust Layer, and Data 360's runtime permission inheritance, and the buyer gets a real 'govern every agent in the enterprise' surface.\n\nApplying the working notes' test and the determinism finding together: every piece of that surface is constraint, not validation, and enforcement, not reasoning. What is genuinely dynamic at this layer is policy enforcement at request time (the gateway), access evaluation at request time (permission inheritance), and task routing (the Broker). All three are live enforcement or dispatch of policy the enterprise authored statically. None places inference, and none validates an outcome. Routing is not reasoning: the Broker dispatches, it does not solve constraints. The universal finding, logged as a /reconcile candidate rather than applied as a Salesforce-only standard: you cannot prompt your way to deterministic output, so the platform's guardrails answer 'is it legal' and never 'is it right.'\n\nCalibration lands moderate, mid-cohort. Above the gap cohort (Qlik, VMware, Nutanix, Dell, VAST), which had inherited permissions and at most a thin gateway rather than a productized governance plane. Peer to Databricks, AWS, and IBM, whose moderates rested on the same shape (a runtime-enforcing gateway plus governed agent identity, enforcing static policy). Below Palantir (strong), which had a genuine reasoning mechanism in Apollo's constraint solver. Cross-platform reach is broader enforcement of the same static policy, a real feature to name but not a higher-order dynamic capability, so it does not lift the grade.\n\nThe GDPR case makes the placement limit concrete. An enterprise with a mix of GDPR and non-GDPR customers wanting inference pinned to region can achieve it by static partition: configure a region-pinned BYOLLM connection and route customers to the right configuration through Data Spaces. That works, and it is a designed partition. What the platform does not offer is a per-request placement policy it evaluates by data-subject residency at request time. You architect the boundary; the platform enforces the one you built. Live placement is the universal Infrastructure-2C gap, Salesforce included.", "borrowedJudgment": "Low for what is provided, all Salesforce IP and Ceded to Salesforce, with no NVIDIA dependency. But this is low borrowed judgment for partial 2C: Intelligence-2C governance is productized, GA, and unusually broad; the reasoning mechanism (an Apollo-class constraint solver) is absent; live inference placement is absent. The Informatica telemetry finding sharpens it. Salesforce now has arguably the richest data-provenance telemetry on the instrument (lineage, catalog, quality, mastered entities), which is exactly the input set a reasoning plane needs (residency for placement, confidence for autonomy gating, classification for access). Sensitivity classification reaches the runtime access and masking enforcement, and catalog and lineage are queryable to agents as context through the Agent Fabric Context Catalog. But no productized 2C engine consumes lineage-residency to place inference or quality-confidence to gate autonomy. The vendor with the best inputs to a reasoning plane ships no plane that reasons over them. The static-configuration surface plus this telemetry is more than the gap cohort ever hands you, and it is not a reasoning plane.", "notes": "Determinism distinction ('you can't prompt your way to deterministic output' / 'legal is not right') carried here as a universal finding and adopted as a 2C scoring-discipline rule (ratified Salesforce v1.0, sibling of 'routing is not reasoning'). A cross-row /reconcile pass applies it to the other rows (it tests the Databricks/AWS/IBM moderates and Palantir's strong); like the live-placement gap it is noted as universal rather than charged to one vendor, so it is expected to confirm more grades than it moves. Sub-threshold signal, prose only: Salesforce Default's managed model mix performs opaque vendor-side model selection, not a customer-configured placement policy. Fact question that could move this to strong: a GA surface where model or region placement is a per-request policy the platform evaluates by compliance context, rather than a static connection binding, or a genuine constraint-satisfaction engine behind the Broker. Read of the docs is routing plus enforcement, which is high-moderate. Fact question that could thin it toward gap: whether Agent Fabric's cross-platform governance is fully deployed and GA versus still maturing.", "components": [ { "component": "MuleSoft Agent Fabric — Agent Governance (Omni / Flex Gateway)", "detail": "GA. Cross-platform policy enforcement at request time: auth, rate limits, token and cost caps, tool-access restrictions, and audit logging on every agent interaction, including agents built outside Salesforce. Live enforcement of statically authored policy, constraint not validation. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "MuleSoft Agent Fabric — Agent Registry & Broker", "detail": "GA. A catalog of agents, tools, and MCP/A2A servers, plus a Broker that routes tasks across A2A-compliant agents. The Broker is task dispatch, flagged under routing-is-not-reasoning: it matches a task to a capability, it does not solve constraints over policy. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Agentforce Runtime Governance (Permission Inheritance + Commit-Boundary Enforcement)", "detail": "Agents inherit object-, field-, and record-level sharing at runtime, and validation rules, before-save Apex, and approval processes gate what commits. The deterministic guardrail on state, the 'legal' half. A facet of the 1A governance surface and the 2B Flow/Apex layer surfaced at the agent-action altitude, not double-counted. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Agentforce Observability (Command Center)", "detail": "GA February 2026. Agent analytics, step-by-step reasoning traceability, and health monitoring. Decision tracing, not decision validation: it reconstructs what an agent did, not whether the outcome was right. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" } ] }, { "id": "layer3", "label": "Layer 3 (+1)", "shortName": "Applications", "title": "AI Application Layer — The Value Plane", "purpose": "AI-powered business capabilities — business logic, workflow automation", "status": "strong", "statusLabel": "Salesforce's Native Layer — First-Party Value Plane", "nvidia": [ { "component": "No NVIDIA Layer 3 Dependency", "detail": "The value plane is Salesforce and ISV IP with model-provider-mediated generation. The near-zero NVIDIA column closes the row empty end to end, broken only by the Beta Nemotron model-availability thread at 2B. Salesforce's borrowed AI judgment flows to the model providers through the LLM Gateway rather than to NVIDIA." } ], "gap": "This is what Salesforce is, and it may be the benchmark first-party value plane on the instrument. The buyer gets the deepest deployed enterprise application estate on the map: Sales, Service, Marketing, and Commerce Clouds plus the industry clouds, running core customer-facing business processes for a huge installed base. Agentforce makes that estate agentic, with action-bearing agents doing real business work (the 85%-resolution service numbers as the proof point). Slack is the conversational work surface, Flow/Apex/Lightning is the platform for custom apps, and AppExchange is the ISV ecosystem.\n\nThis is the coupled, visible capture, and it is the mirror of the 1A finding. At 1A, zero-copy makes the capture decoupled and invisible; here your business runs in Salesforce's namespace, decades deep, and the lock-in was never in doubt. Org config, custom objects, Apex, Flows, page layouts, automations, and agent definitions are the largest captive estate in the row, the deepest coupled lock-in on the instrument.\n\nCalibration is strong and frontier-pegged (rule 6): peer to Palantir, Databricks, and Qlik, and broader than all three. Databricks and Qlik carry an analytics-bounded caveat; Palantir's operational apps are Forward-Deployed-Engineering-delivered and bespoke, where Salesforce's are productized across every customer-facing function. Above VMware and Nutanix (moderate, platform-enabled not platform-provided). Not partner (Dell, Cisco, HPE, IBM), because this value plane is emphatically first-party. The honest caveat matches how peers got theirs: the domain is customer engagement and the business processes around it, the largest domain any Layer 3 strong covers, but still a domain. It is not the ERP and financial core, and not arbitrary enterprise operations.", "borrowedJudgment": "The application opinions are Salesforce's, Ceded to Salesforce, and the accumulated org estate is the largest captive artifact set in the row. The generative layer inside the apps inherits the model chain from 2B (portable model choice, Salesforce-governed runtime). The AppExchange ecosystem is Delegated. Coupled, visible capture throughout: the buyer knows exactly what they have committed to here, the honest inverse of the 1A decoupled ask.", "notes": "All scored components are doc- and release-confirmed; nothing here rests on inference, and no open fact questions.", "components": [ { "component": "Customer 360 Applications (Sales / Service / Marketing / Commerce + Industry Clouds)", "detail": "The first-party application estate running core customer-facing business processes. The deepest coupled capture in enterprise software: decades of process and configuration lift nowhere. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Agentforce Agents (Action-Bearing Business Execution)", "detail": "Agents that resolve cases, qualify leads, and execute real business actions on the object model under commit-boundary governance. Agent definitions, topics, and actions are captive; the reasoning core is inherited from 2B. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Platform (Flow, Apex, Lightning)", "detail": "The application platform for custom apps and workflows. Apex and Flow run only on Salesforce and Lightning apps do not lift. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "Slack (Agentic Work Surface)", "detail": "The Salesforce-owned collaboration and agent-interaction surface, now a primary channel for Agentforce. Proprietary Salesforce platform, no open exit.", "dapm": "Ceded" }, { "component": "AppExchange (ISV Ecosystem)", "detail": "The third-party application marketplace. Menu-altitude Delegated: the pre-purchase choice among substitutable ISVs is real, and each deployed app captures per its own terms. Matches Dell's Ecosystem Program and the Databricks Marketplace.", "dapm": "Delegated" } ] } ] }