In the context of Agentforce AI, grounding and data security are paramount. Salesforce AI agents, including Employee Agents, respect the existing security model of the Salesforce organization1. This means that the most effective way to prevent an agent from accessing or disclosing sensitive information, such as a CEO's private health plan, is to leverage Field-Level Security (FLS) and user permissions2. When an agent "grounds" its response, it only considers data that the running user (or the agent's service user) has the permission to view3. If the CEO's health records are stored in fields or records that are restricted via FLS or Sharing Settings from the profiles or permission sets used by the agent's context, the agent will simply not "see" that data during its retrieval phase4. While modifying instructions and guardrails (Option C) provides an additional layer of safety, it is not as foolproof as the underlying security architecture5. Training the agent (Option D) is not a standard configuration step for preventing specific record access in a production environment6. Therefore, maintaining a robust security model is the critical prerequisite for ensuring that AI agents provide accurate and safe responses without leaking confidential business information.

In Salesforce, security restrictions like Login Hours and Login IP Ranges are managed at the Profile level. When these are configured on a profile, they are strictly enforced; if a user attempts to log in outside of the allowed hours or from an unauthorized IP address, the system will deny access entirely. This is one of the most robust ways to secure an organization against unauthorized access. Company Settings (Option A) can set "Trusted IP Ranges" for the whole org, but these only bypass multi-factor authentication; they do not restrict login. Roles (Option B) control record visibility, not system access. While Permission Sets (Option D) can grant many permissions, Login Hours and IP Ranges remain a core profile-level security setting.

To manage different levels of support service (Gold, Silver, Bronze), Salesforce uses the Entitlement Management feature. An "Entitlement" defines the specific type of support a customer is eligible for. To "ensure that this is part of every client's account" automatically, a Platform Administrator should use Flow Builder. A record-triggered flow can be set to run whenever an Account is updated to "Customer" status or when a specific "Service Level" field is populated. The flow can then automatically create or link an Entitlement record to that Account. This ensures that when a new case is opened, the support agent immediately sees the SLA (Service Level Agreement) associated with that customer. Routing Configurations (Option B) and Assignment Rules (Option D) handle who gets the case, but they do not define the level of service. Email-to-Case (Option C) is an intake method, not a service-level tracking tool.

Case Assignment Rules are the standard Salesforce tool for automatically routing cases to specific users or queues based on record criteria. A single assignment rule can contain multiple "Rule Entries" processed in a specific order. To meet this requirement, the Platform Administrator would create a rule with two entries: one that checks if the Account's "Level" field equals "Platinum" and routes it to the Priority Support Queue, and another that checks if the level is "Silver" or "Gold" and routes it to the Regular Support Queue. This automation happens the moment the case is created, ensuring that high-value customers receive immediate attention from the appropriate team. Escalation Rules (Option A) are used to move a case after it has been sitting for a period of time, not for initial routing. Workflow Rules (Option D) are a legacy tool that cannot natively assign cases to queues in the same direct manner as Assignment Rules.

To track specific stages of a support process and measure the time elapsed within those stages, Salesforce provides Entitlements and Milestones . Milestones represent required steps in a support process, such as "First Response Time" or "Resolution Time"363636. When combined with Business Hours, Milestones allow the system to accurately calculate how long a case has been in a particular status or assigned to a specific team, excluding weekends or non-working hours . This provides leadership with granular reporting on "Team Performance" and SLA compliance . Escalation Rules (Option A) and Assignment Rules (Option C) are primarily routing tools; they can move a case but do not natively provide the timestamp-based tracking and reporting necessary to see duration across multiple "handoffs" . Record-Triggered Flows (Option B) could theoretically be used to stamp fields, but this would require significant custom development and would not offer the native, out-of-the-box reporting dashboards that come with the Milestones feature40. Therefore, Entitlement Management is the standard solution for tracking time-based service metrics41.