Salesforce Connector Setup & RBAC

The Salesforce MCP connector allows agents to read accounts, update leads, and manage opportunities within designated boundaries — without exposing admin-level CRM access to the LLM.

Setup Variables

• Instance URL: Your custom Salesforce domain URL (e.g. https://yourorg.my.salesforce.com).
• OAuth Scopes: Standard permissions such as api and refresh_token.
• Credentials Reference: Connected App client ID and secret hydrated securely inside the MakeYourMCP vault — never passed to the LLM context.

Why Salesforce Needs RBAC in AI Agent Pipelines

Salesforce CRMs contain an organisation's most sensitive commercial data: deal values, competitive intelligence, customer contract terms, and executive contact details. AI sales agents with broad Salesforce access can: (1) accidentally update opportunity values or close dates based on hallucinated LLM output, (2) expose sensitive account data to the LLM context window where it can be inadvertently leaked in chat transcripts, and (3) create or delete records at scale without human review. MakeYourMCP enforces object-level RBAC (limiting the agent to specific Salesforce objects like Leads, not Contracts), field-level masking (hiding sensitive financial fields), and approval gates on any write action that modifies closed or high-value opportunities.

Example RBAC Policy

version: "mcp/v1alpha1"
metadata:
  id: "policy_salesforce_sdr_agent"
  name: "SDR Agent — Lead Qualification & Read-Only Opportunities"

rules:
  - id: "rule_sf_read_leads"
    role: "sdr_agent"
    resource: "salesforce.Lead.*"
    actions:
      - "read"
      - "query"
    constraints:
      masked_fields:
        - "MobilePhone"
        - "HomePhone"
    approval:
      required: false

  - id: "rule_sf_update_lead_status"
    role: "sdr_agent"
    resource: "salesforce.Lead.Status"
    actions:
      - "update"
    approval:
      required: false

  - id: "rule_sf_block_high_value_opps"
    role: "sdr_agent"
    resource: "salesforce.Opportunity"
    actions:
      - "update"
      - "delete"
    effect: "deny"

Common Pitfalls

• Granting access at the org level instead of object level: Salesforce Connected Apps with the full api scope allow reading all objects. Always pair the Connected App OAuth scope with MakeYourMCP object-level RBAC rules to enforce the principle of least privilege at both layers.
• No field masking on sensitive CRM fields: Salesforce Leads and Contacts often contain personal mobile numbers, revenue data, and credit terms. Without field masking, these values enter the LLM context window and can appear in chat outputs or be logged.
• Allowing agents to update Opportunity stage or close date: LLMs can hallucinate close dates or update stages based on conversation context. Always put approval: required: true on any Opportunity write action to ensure a human reviews agent-initiated CRM modifications.

See Also

• PostgreSQL Connector Setup Guide — transactional data alongside Salesforce CRM
• Snowflake Connector Setup Guide — analytics joined with CRM data
• Slack Connector Setup Guide — notify sales teams via Slack on CRM events
• GitHub Connector Setup Guide — engineering agents alongside CRM data
• Policy YAML Schema Reference — full policy declaration specification
• Full Documentation Index
• Credential Vaulting for AI Workflows — how CRM secrets are protected server-side
• MakeYourMCP Security & Trust Center — full security architecture overview

← Back to documentation index