@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/skills/salesforce/README.md

@@ -0,0 +1,117 @@
+# Salesforce Skills
+
+<p align="center">
+  <img src="../../assets/logos/cloud/salesforce/salesforce.svg" alt="Salesforce logo" width="200" />
+</p>
+
+This directory contains **25** Salesforce domain skills curated for this marketplace, spanning four execution tiers and four delivery waves.
+
+Provider: `salesforce`
+Lifecycle: `experimental`
+Author: `github: Raishin`
+
+---
+
+## Execution tiers
+
+Skills in this portfolio are classified by the [execution-tier contract](../../docs/execution-tiers.md):
+
+| Tier | Label | Blast radius |
+|---|---|---|
+| T0 | `static-review` | Zero — no network egress, operates on local files and pasted exports only |
+| T1 | `read-only-runtime` | Bounded — read-only CLI access to a connected org; outputs sanitized |
+| T2 | `sandbox-mutating` | Scoped — mutation allowed only in SANDBOX orgs; production hard-refused |
+| T3 | `production-mutating` | **Prohibited for all agents** — routed through Live Guard and human approval |
+
+---
+
+## Wave 1 — Static review (T0): core advisory skills
+
+Nine foundational review disciplines. No network access; all inputs are sanitized exports or pasted configuration.
+
+| Skill | Tier | Summary |
+|---|---|---|
+| `salesforce-org-assessment-skill` | `static-review` | Org posture baseline from sanitized exports — object model, automation inventory, permission topology, integration map, technical debt |
+| `salesforce-metadata-review-skill` | `static-review` | Reviews metadata (objects, fields, layouts, LWC record pages, profiles, permission sets, sharing rules) for over-customization and deprecated types |
+| `salesforce-permission-model-review-skill` | `static-review` | Audits profiles, permission sets, permission set groups, sharing rules, OWD, role hierarchy, IP restrictions, and session policies; flags toxic combinations |
+| `salesforce-flow-automation-review-skill` | `static-review` | Reviews Flow XML, validation rules, approval processes, and record-triggered automation for recursion, ungoverned bypass, brittle null handling, and governor-limit risk |
+| `salesforce-apex-lwc-code-review-skill` | `static-review` | Reviews Apex classes, triggers, LWC, and async jobs for SOQL/DML in loops, sharing keyword omission, governor-limit risk, LWC XSS surface, and Locker Service issues |
+| `salesforce-release-readiness-skill` | `static-review` | Pre-release checklist covering sandbox refresh strategy, test coverage threshold, destructiveChanges.xml review, rollback plan, and approval matrix |
+| `salesforce-integration-review-skill` | `static-review` | Reviews integration designs for API choice, middleware position, retry/idempotency patterns, secret handling, OAuth scope minimization, and MuleSoft architecture |
+| `salesforce-marketing-consent-review-skill` | `static-review` | Reviews Marketing Cloud, Account Engagement, and Data Cloud flows for consent capture, lawful basis, suppression list integrity, and deliverability authentication |
+| `salesforce-agentforce-risk-review-skill` | `static-review` | Reviews Agentforce and Salesforce AI configurations for grounding quality, action allowlist safety, human handoff design, hallucination containment, and model-risk controls
+|
+
+---
+
+## Wave 2 — Infrastructure and zero-trust review (T0)
+
+Four specialized review disciplines for infrastructure security and DevSecOps posture.
+
+| Skill | Tier | Summary |
+|---|---|---|
+| `salesforce-zero-trust-maturity-skill` | `static-review` | Evaluates Salesforce deployment zero-trust readiness against NIST SP 800-207 — MFA posture, network policies, least-privilege identity, continuous verification |
+| `salesforce-infrastructure-audit-skill` | `static-review` | Structured audit of Salesforce infrastructure security posture including Hyperforce configuration, network policies, certificate management, and sandbox governance
+|
+| `salesforce-devsecops-pipeline-skill` | `static-review` | Reviews Salesforce CI/CD pipeline configurations — SFDX/Salesforce CLI usage, dependency scanning, secrets handling, deployment gating, and branch protection |
+| `salesforce-soql-explorer-skill` | `static-review` | Analyzes SOQL query patterns from pasted query text for bulkification, index usage, LIMIT/OFFSET anti-patterns, and sharing enforcement |
+
+---
+
+## Wave 3 — Generation skills (T0)
+
+Six code and artifact generation skills. All generate output locally from conversation context; none execute against a live org.
+
+| Skill | Tier | Summary |
+|---|---|---|
+| `salesforce-soql-generator-skill` | `static-review` | Generates SOQL queries from plain-English requirements without executing against an org — includes WITH SECURITY_ENFORCED and field-level security annotations |
+| `salesforce-apex-generator-skill` | `static-review` | Generates production-grade Apex classes with Service-Selector-Domain layering, CRUD/FLS enforcement, and governor-limit patterns |
+| `salesforce-apex-test-generator-skill` | `static-review` | Generates Apex test classes with TestDataFactory patterns, Assert class usage, and bulkification test cases |
+| `salesforce-validation-rule-writer-skill` | `static-review` | Converts plain-English business rules into deployable Salesforce Validation Rule formula syntax |
+| `salesforce-field-mapping-skill` | `static-review` | Maps CSV and spreadsheet column headers to Salesforce field API names and resolves picklist values for data-load preparation |
+| `salesforce-bulk-data-ops-skill` | `static-review` | Generates scripts for bulk Salesforce data operations — mass owner reassignment, archive extraction, and Data Loader job configuration |
+
+---
+
+## Wave 4 — Operational skills (T1 and T2)
+
+Six skills with live connectivity, distinguishing this portfolio from pure static review. T1 skills are read-only; T2 skills require sandbox-only target confirmation and hard-refuse production org targets.
+
+| Skill | Tier | Summary |
+|---|---|---|
+| `salesforce-metadata-fetcher-skill` | `read-only-runtime` | Fetches Salesforce metadata (objects, fields, flows, validation rules) from a connected org via `sf sobject describe` and metadata API reads — read-only |
+| `salesforce-agentforce-stdm-observer-skill` | `read-only-runtime` | Queries Salesforce Telemetry and Data Management (STDM) and Data Cloud
+event streams in read-only mode for Agentforce operational monitoring |
+| `salesforce-apex-test-runner-skill` | `read-only-runtime` | Executes Apex tests against a connected sandbox org via `sf apex run test` — observes results only; does not deploy or modify org state |
+| `salesforce-apex-log-analyzer-skill` | `read-only-runtime` | Retrieves Apex debug logs from a connected Salesforce org and analyzes them for governor-limit breaches, exceptions, and SOQL/DML patterns |
+| `salesforce-flow-debugger-skill` | `read-only-runtime` | Diagnoses Salesforce Flow failures from pasted error messages (T0 mode) or live debug log retrieval (T1 mode) — read-only observation only |
+| `salesforce-deployment-validator-skill` | `sandbox-mutating` | Runs `sf project deploy validate` against a SANDBOX org — validation only, no commit; hard-refuses production targets |
+
+---
+
+## Companion protocol skills
+
+Five cross-functional protocol skills in `skills/cross-functional/` govern how Salesforce matters are classified, routed, and handed off:
+
+| Protocol skill | Purpose |
+|---|---|
+| `salesforce-routing-protocol` | Classification and routing discipline for Salesforce matters |
+| `salesforce-case-capsule` | Standardized cross-agent handoff structure |
+| `salesforce-risk-taxonomy` | Matter types, risk tiers, and escalation gates |
+| `salesforce-live-change-approval-protocol` | Refusal-by-default gate for live org mutations |
+| `salesforce-data-exposure-escalation-protocol` | Immediate escalation path for data exposure events |
+
+---
+
+## Security and operating principles
+
+- T0 skills are read-only, static-review disciplines — no network egress, no credentials.
+- T1 skills require read-only OAuth scopes (`api refresh_token`) against a pre-authorized Connected App; outputs are sanitized before emission.
+- T2 skills hard-refuse production org targets at the skill level; production targets are never agent-callable.
+- No skill requests live org credentials, session IDs, OAuth tokens, or customer data in conversation context.
+- All inputs must be sanitized before submission; org IDs and user IDs must be replaced with placeholders.
+- Advisory findings require human authorization before any remediation action.
+- Regulated-vertical findings (HIPAA, PCI, FINRA) are always escalated to qualified compliance counsel.
+- Escalation gates from `salesforce-risk-taxonomy` are hard stops, not suggestions.
+
+Run `npm run validate` after changing cataloged Salesforce skills.

package/skills/salesforce/salesforce-agentforce-risk-review-skill/SKILL.md

@@ -0,0 +1,206 @@
+---
+name: salesforce-agentforce-risk-review-skill
+description: Use this skill when an Agentforce or Salesforce AI agent configuration must be reviewed for grounding quality, retrieval scope, action allowlist safety, human handoff design, hallucination containment, prompt injection surface, autonomous action boundary, audit logging, and model-risk controls. Trigger phrases: "review this Agentforce configuration", "assess the risk of this AI agent", "check the action allowlist for this agent", "review grounding and retrieval scope", "is this autonomous AI action safe". Do not use when the subject is a general Salesforce Flow or automation (use salesforce-flow-automation-review-skill), when a live Agentforce deployment is being pushed to production (use salesforce-live-change-approval-protocol), or when the focus is general Apex code quality (use salesforce-apex-lwc-code-review-skill). All Agentforce and Einstein feature names carryannotations; validate current terminology against official Salesforce documentation before use. Works from sanitized configuration exports only; never requests live org access.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-20"
+  category: ai
+  lifecycle: experimental
+---
+
+# Salesforce Agentforce Risk Review Skill
+
+## Purpose
+This skill reviews Salesforce Agentforce
+and AI agent configurations for model-risk controls, grounding quality,
+retrieval scope, action allowlist safety, human handoff design, hallucination
+containment, prompt injection surface, autonomous action boundaries, and audit
+logging. It exists because AI agents operating on live Salesforce data and
+business processes carry unique risks — autonomous actions, scope creep, and
+hallucination-driven errors can cause irreversible data changes or compliance
+failures. It does not access live orgs or execute agent actions.
+
+**notice:** All Agentforce, Einstein, Data Cloud, and
+related AI feature names in this skill carry a verification requirement.
+Salesforce AI product naming, feature availability, and configuration
+interfaces evolve rapidly. Validate all product references against the
+current official Salesforce documentation before use.
+
+## When to use
+- An Agentforce agent configuration is being reviewed before deployment.
+- An AI agent's action allowlist has been expanded and must be risk-assessed.
+- A human handoff design for an AI agent needs review.
+- An AI agent has taken an unexpected action and the configuration must be analyzed.
+- Model-risk controls for a Salesforce AI deployment must be documented.
+
+## When not to use
+- General Salesforce Flow or automation (not AI) — use `salesforce-flow-automation-review-skill`.
+- Live Agentforce deployment to production — use `salesforce-live-change-approval-protocol`.
+- Apex code quality (not AI configuration) — use `salesforce-apex-lwc-code-review-skill`.
+- Marketing AI features (consent and data flow focus) — use `salesforce-marketing-consent-review-skill`.
+
+## Minimum payload (required inputs)
+- Sanitized Agentforce  agent
+  configuration: agent name, role description, topic assignments, action
+  allowlist, grounding configuration.
+- Description of the agent's intended scope and business function.
+- Human handoff design: conditions under which the agent escalates to a human.
+- Audit logging configuration (or note that it is undocumented).
+- Environment: sandbox or production (use placeholder).
+
+## Workflow
+
+### 1. Grounding and retrieval scope review
+- Verify that the agent's knowledge base or retrieval source is scoped to
+  the minimum necessary data.
+- Flag: agents with retrieval access to all records in an object without
+  field-level or record-level restriction.
+- Flag: agents using Einstein Search
+  or Data Cloud  knowledge without
+  documented retrieval scope limits.
+- Flag: retrieval of data from objects containing PII or regulated data
+  without documented access justification.
+- Flag: agents grounded on unversioned or unmonitored knowledge sources
+  (stale grounding can cause hallucination).
+
+### 2. Action allowlist review
+- Review the list of actions the agent is permitted to take (Apex actions,
+  Flow invocations, external callouts).
+- Flag: actions that mutate production records without a human confirmation step.
+- Flag: actions that send external communications (email, SMS) autonomously.
+- Flag: actions that access financial, HR, or regulated-data records.
+- Flag: actions not explicitly allowlisted (if the agent has a default-permit
+  posture, flag as Critical).
+- Flag: actions that can invoke other agents or escalate permissions.
+
+### 3. Human handoff design
+- Verify that human handoff conditions are defined.
+- Flag: no handoff condition (agent runs to completion without any human
+  escalation path).
+- Flag: handoff conditions that are too narrow (agent can be steered away
+  from handoff by adversarial input).
+- Flag: handoff destination is not a monitored queue or live human (voicemail,
+  unmonitored inbox).
+- Flag: handoff does not preserve conversation context (human receives no
+  session summary).
+
+### 4. Hallucination containment
+- Verify that the agent's responses are grounded in retrieved data, not
+  model-generated facts.
+- Flag: agent configured to answer questions about policies, regulations, or
+  financial data without a retrieval step (pure generation from model).
+- Flag: no output validation or confidence threshold before external-facing
+  response.
+- Flag: agent presents retrieved data as guaranteed fact without a confidence
+  indicator.
+
+### 5. Prompt injection surface
+- Review how user input is incorporated into agent prompts.
+- Flag: user-supplied text inserted directly into a system prompt or
+  instruction template without sanitization.
+- Flag: agent configured to follow instructions in user-supplied documents
+  (uploaded files, email bodies) without an injection guard.
+- Flag: agent lacks detection for adversarial instructions embedded in
+  retrieved knowledge.
+
+### 6. Autonomous action boundary
+- Verify that autonomous action boundaries are explicitly defined and enforced.
+- Flag: agent can take actions across multiple records in a single invocation
+  without a configurable limit.
+- Flag: agent can chain actions in a loop without a termination condition.
+- Flag: agent has write access to objects it does not need to read
+  (least-privilege violation).
+- Flag: sandbox-only actions enabled in the production agent configuration.
+- Flag: agent can modify its own configuration or the configurations of other
+  agents.
+
+### 7. Audit logging
+- Verify that agent actions are logged with: agent ID, action taken, record
+  affected (placeholder), timestamp, user or session context, outcome.
+- Flag: audit logging disabled or not configured.
+- Flag: audit log does not capture failed actions or handoff events.
+- Flag: audit log not retained for the minimum required period for the industry
+  vertical.
+- Flag: audit log accessible to the agent itself (self-modification risk).
+
+### 8. Model-risk controls
+- Verify that model-risk controls are documented:
+  - Model version pinned or version-change alert in place.
+  - Acceptable use policy for the AI feature defined.
+  - Human oversight mechanism for high-stakes actions.
+  - Incident response plan for AI-driven errors.
+- Flag: no model version pinning (silent model update can change agent behavior).
+- Flag: no acceptable use policy documented for the AI deployment.
+- Flag: no incident response plan for AI-driven errors.
+
+## Evidence requirements
+- Sanitized agent configuration export or detailed description; no credentials,
+  session tokens, or customer data.
+- Action allowlist (complete list of permitted actions).
+- Human handoff conditions.
+- Audit logging configuration.
+
+## Output format
+```
+agentforce_risk_review_findings:
+  grounding_retrieval:
+    - finding: [description]
+      severity: Critical | High | Medium | Low
+      verify_before_merge: [feature name if applicable]
+      recommendation: [brief]
+  action_allowlist: [same structure]
+  human_handoff: [same structure]
+  hallucination_containment: [same structure]
+  prompt_injection: [same structure]
+  autonomous_action_boundary: [same structure]
+  audit_logging: [same structure]
+  model_risk_controls: [same structure]
+
+summary:
+  total_findings: [count]
+  critical_count: [count]
+  high_count: [count]
+escalation_gates_fired: [from salesforce-risk-taxonomy — autonomous-ai-action gate if applicable]
+verify_before_merge_items: [list of product names requiring verification]
+assumptions: [list]
+missing_evidence: [what would improve the review]
+```
+
+## Redaction rules
+- Never request secrets, credentials, OAuth tokens, refresh tokens, session IDs, MFA seeds, customer PII.
+- Sanitize org IDs, user IDs, and agent session IDs (replace with placeholders) before sharing in outputs.
+- Agent conversation logs containing customer data must not be included in review inputs.
+
+## Privilege / data handling rules
+- AI agent configurations involving regulated data (health, financial) escalate to compliance review.
+- Audit logs are evidence of AI behavior; handle as compliance records.
+- Model-risk findings may have regulatory implications in regulated verticals; route to compliance counsel.
+
+## Handoff rules
+- Hands off to: salesforce-permission-model-review-skill (if agent permission scope is excessive),
+  salesforce-data-exposure-escalation-protocol (if autonomous AI action creates data exposure),
+  salesforce-live-change-approval-protocol (if production Agentforce deployment is next),
+  salesforce-case-capsule (structured handoff for any Critical finding).
+- Required handoff fields: matter_id, critical_count, escalation_gates_fired,
+  autonomous_action_boundary summary, verify_before_merge_items.
+
+## Audit log fields
+- matter_id, skill_id, skill_version, invoked_by, input_hash, evidence_quality, output_verdict, escalation_fired, timestamp
+
+## Stop conditions
+- Agent configuration shows autonomous write access to regulated-data objects without human confirmation — fire autonomous-ai-action gate immediately.
+- Action allowlist is effectively unbounded (default-permit) — Critical finding; recommend disabling agent until allowlist is defined.
+- Audit logging is disabled in a production agent — Critical finding; escalate to human review before any agent invocation.
+- Agent can modify its own configuration — Critical finding; stop and escalate.
+
+## Security notes
+- All Agentforce and Einstein feature names require verification against current
+  Salesforce documentation before use in production contexts.
+- Autonomous action boundary violations are always escalation-grade regardless
+  of the action's apparent severity.
+- Prompt injection is an active threat surface; agent configurations that
+  incorporate uncontrolled user input without sanitization are Critical risks.
+- This skill does not execute agent actions, access live agent sessions, or
+  retrieve model outputs. Review is configuration-level only.

package/skills/salesforce/salesforce-agentforce-risk-review-skill/metadata.json

@@ -0,0 +1,18 @@
+{
+  "id": "salesforce-agentforce-risk-review-skill",
+  "name": "Salesforce Agentforce Risk Review Skill",
+  "type": "skill",
+  "provider": "salesforce",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Reviews Agentforce and Salesforce AI agent configurations for grounding quality, retrieval scope, action allowlist safety, human handoff design, hallucination containment, prompt injection surface, autonomous action boundary, audit logging, and model-risk controls. All Agentforce and Einstein feature names carry.",
+  "source_type": "original",
+  "official_docs": [
+    "https://help.salesforce.com/",
+    "https://developer.salesforce.com/docs"
+  ],
+  "security_notes": "Read-only static configuration review; sanitized exports only; never executes agent actions or requests live org credentials. Autonomous action boundary violations always escalation-grade. All Agentforce product names require verification against current Salesforce documentation.",
+  "last_verified": "2026-05-20",
+  "path": "skills/salesforce/salesforce-agentforce-risk-review-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/salesforce/salesforce-agentforce-risk-review-skill/references/action-safety-matrix.md

@@ -0,0 +1,160 @@
+# Action Safety Matrix Reference
+
+Classification of Agentforce
+actions by autonomy risk tier,
+required safeguards, and human-confirmation requirements.
+
+---
+
+## Risk Tier Definitions
+
+| Tier | Label | Description |
+|------|-------|-------------|
+| 0 | Safe/Read-Only | Read operations, status lookups, informational responses |
+| 1 | Low-Risk Write | Creates non-sensitive records, sends non-regulated notifications |
+| 2 | Medium-Risk Write | Modifies existing records, updates financial or status fields |
+| 3 | High-Risk Write | Deletes records, transfers ownership, submits external transactions |
+| 4 | Critical/Irreversible | Data export, regulatory filings, payment processing |
+
+---
+
+## Action Category Matrix
+
+### CRM Record Operations
+
+| Action | Tier | Autonomous OK | Confirmation Required | Human Handoff Required |
+|--------|------|--------------|----------------------|----------------------|
+| Query (SOQL read) | 0 | Yes | No | No |
+| Create Case | 1 | Yes | Recommended | No |
+| Create Contact | 1 | Yes | Recommended | No |
+| Update Case Status | 2 | Conditional | If closing | No |
+| Update Opportunity Stage | 2 | No | Yes | Recommended |
+| Update Account billing info | 3 | No | Yes | Yes |
+| Delete record (any) | 3 | No | Yes | Yes |
+| Transfer Case ownership | 2 | Yes | If cross-team | No |
+| Mass update (>50 records) | 3 | No | Yes | Yes |
+| Merge records | 3 | No | Yes | Yes |
+
+### Communication Actions
+
+| Action | Tier | Autonomous OK | Confirmation Required | Human Handoff Required |
+|--------|------|--------------|----------------------|----------------------|
+| Send Email (transactional) | 1 | Yes | No | No |
+| Send Email (marketing) | 2 | No | Yes | No |
+| Send SMS
+| 1 | Yes | No | No |
+| Log a call | 0 | Yes | No | No |
+| Post to Chatter (internal) | 1 | Yes | No | No |
+| Publish to Community | 2 | No | Yes | No |
+
+### External Callout Actions
+
+| Action | Tier | Autonomous OK | Confirmation Required | Human Handoff Required |
+|--------|------|--------------|----------------------|----------------------|
+| GET to external API | 0 | Yes | No | No |
+| POST to external API (idempotent) | 1 | Yes | No | No |
+| POST to external API (non-idempotent) | 2 | No | Yes | No |
+| Payment/financial API call | 4 | No | Yes | Yes |
+| External identity verification | 3 | No | Yes | Yes |
+
+### Data and Privacy Actions
+
+| Action | Tier | Autonomous OK | Confirmation Required | Human Handoff Required |
+|--------|------|--------------|----------------------|----------------------|
+| Return own-account data to authenticated user | 1 | Yes | No | No |
+| Return third-party data in response | 3 | No | Yes | Yes |
+| Export record data to file/link | 4 | No | Yes | Yes |
+| Process data deletion (DSAR) | 4 | No | Yes | Yes |
+| Update consent preferences | 3 | No | Yes | Recommended |
+
+### Flow and Automation Trigger Actions
+
+| Action | Tier | Autonomous OK | Confirmation Required | Human Handoff Required |
+|--------|------|--------------|----------------------|----------------------|
+| Launch Screen Flow | 0 | Yes | No | No |
+| Launch Autolaunched Flow (read) | 1 | Yes | No | No |
+| Launch Autolaunched Flow (write) | 2 | Conditional | If write path taken | No |
+| Submit Approval Process | 2 | No | Yes | No |
+| Recall Approval | 3 | No | Yes | Yes |
+| Run Scheduled Apex | 3 | No | Yes | No |
+
+---
+
+## Safeguard Requirements by Tier
+
+### Tier 0: No additional safeguards required.
+
+### Tier 1: Logging required.
+- Record agent conversation ID in the created/updated record's audit field or
+  a custom `AgentActionLog__c` object.
+- Confirm no PII is returned in the response payload beyond what the user is
+  authorized to view.
+
+### Tier 2: Confirmation dialog required.
+```
+Before executing: present a structured confirmation message to the user:
+  "I am about to [action summary]. Please confirm with 'Yes' to proceed or
+   'No' to cancel."
+Log: AgentConversationId, ActionName, RecordId, Timestamp, UserConfirmation
+```
+
+### Tier 3: Human handoff or manager approval required.
+- Trigger a Transfer to Agent action to a qualified human queue OR
+- Invoke an Approval Process and wait for asynchronous approval before acting.
+- Never execute Tier-3 actions inline without out-of-band approval.
+
+### Tier 4: Full audit trail and dual authorization required.
+- Agent must NOT execute autonomously.
+- Action must be queued for human review with full audit record.
+- Dual authorization (two named humans) required for financial and data export actions.
+- Retain audit record for minimum 7 years (regulatory default; adjust per vertical).
+
+---
+
+## Autonomous vs Human-Confirmed: Decision Flowchart
+
+```
+Is the action read-only?
+  YES -> Tier 0. No confirmation needed.
+  NO ->
+    Does the action affect > 1 record or > 1 object?
+      YES -> Tier 2 minimum. Confirmation required.
+      NO ->
+        Does it affect financial, legal, or regulated data?
+          YES -> Tier 3 or 4. Human handoff required.
+          NO ->
+            Does it trigger an external system?
+              YES (non-idempotent) -> Tier 2 minimum.
+              NO -> Tier 1. Logging required.
+```
+
+---
+
+## Reference: Agentforce Action Types
+
+| Action Type | Metadata API Name | Notes |
+|-------------|------------------|-------|
+| Apex Action | `ApexAction` | Full Apex governor limits apply |
+| Flow Action | `FlowAction` | Respects running user's sharing |
+| Prompt Action | `PromptAction` | No DML; generates text response |
+| External Service Action | `ExternalServiceAction` | Requires Named Credential |
+| Standard Agent Action | `StandardAction` | Salesforce-provided, reviewed by Salesforce |
+
+---
+
+## Audit Log Fields to Capture for Every Action
+
+```
+AgentActionLog__c {
+  ConversationId__c    : String(255)   // Agentforce session ID
+  ActionName__c        : String(255)   // Exact action metadata name
+  ActionTier__c        : Picklist      // 0/1/2/3/4
+  ExecutedAt__c        : DateTime
+  RunningUserId__c     : Lookup(User)
+  TargetRecordId__c    : String(18)    // If a record was affected
+  ConfirmedByUser__c   : Boolean
+  HandoffTriggered__c  : Boolean
+  OutcomeStatus__c     : Picklist      // Success/Failure/Cancelled
+  ErrorMessage__c      : LongTextArea  // If failure
+}
+```