Loading
Prepare for Email to Become the Default Login ExperienceRead More
Agentforce and Einstein Generative AI
User-Level Authentication in Multi-Agent Solutions

You are here:

  1. Salesforce Help
  2. Docs
  3. Quickstart Your Einstein Generative AI Solution

User-Level Authentication in Multi-Agent Solutions

Agentforce multi-agent solutions support user-level authentication. Authentication varies by agent type and by the combination of orchestrator agent and connected subagent.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, Unlimited, and Developer Editions. Required add-on licenses vary by agent type.

Authentication for Agent Type Combinations

Orchestrator Agent Connected Subagent Authentication
ASA ASA

For ASA, a connected subagent runs as the orchestrator agent's session user (the digital user), not as its own agent user. After a customer logs in to the ASA orchestrator, the platform passes that identity through the authenticated session. You can't change the connected subagent's running user with an access element, a variable, or a linked variable.

Unauthenticated guest users are also supported.
AEA AEA AEA connected subagents run in the logged-in user's context. The user must be logged in beforehand. Variables such as currentUserId aren't available in this context, which is by design for security reasons.
AEA ASA An ASA connected subagent runs as its own agent user, not in the logged-in user's context. Configure the ASA agent user with the permissions required to perform its actions.

For AEA, assign the logged-in user the permissions required for any operation the connected subagent requests.

Note
Note

An ASA orchestrator with AEA connected subagents isn't supported in this release.

For additional information, see:

 
Loading
Salesforce Help | Article