Legal and Ethical Considerations with Headless Functionality

Legal Considerations

With headless functionality, third-party agents (each a “Non-SFDC Application”) may have the ability to enable Salesforce features that are off by default, such as beta services that aren’t yet Generally Available, and features that leverage different infrastructure and/or use Einstein Generative AI. For more information on specific features, see the Help Documentation for that particular feature.

Due to the nature of generative artificial intelligence (AI), the output from third-party agents may be unpredictable, and may include inaccurate or harmful responses. Before using any generative AI output, the Customer is solely responsible for reviewing the output for accuracy, safety, and compliance with applicable laws and third-party acceptable use policies.

Ethical AI Considerations

Ethical AI is an essential part of Salesforce's commitment to the ethical and humane use of technology. Salesforce centers its ethical AI approach on five principles: accuracy, safety, honesty, empowerment, and sustainability. To achieve these principles, the platform uses the Einstein Trust Layer to mask sensitive data, prevent toxic outputs, and reduce hallucinations before prompts reach large language models. In headless use cases, the user must acknowledge that a simple disclaimer isn't enough and in fact, there may not be a UI involved to see a visual cue or disclaimer warning of the use of AI.

Accountability and Clear Expectations

To make sure that headless apps operate responsibly and reliably, teams should prioritize clear communication and maintain human-led oversight.

• The Predictable Interface: When we decouple business logic from the web page, the data and actions we expose represent a promise. Designing predictable connection points ensures dependent apps and AI agents function on a stable foundation.

• AI as the Assistant, Humans as the Architects: While AI can help automate repetitive building tasks, human oversight is non-negotiable. We establish best practices to guarantee that design decisions, ethical boundaries, and final quality checks remain firmly under human control.

Context-Aware Safety

As it is in any use case, sharing data responsibly is a top priority.

• Tailored Data Protection: Rather than relying on a rigid "all or nothing" access policy, we discuss how to selectively share information. We evaluate who is requesting the data, why they need it, and how sensitive the information. And then we dynamically adjust what is shared.

• Protecting Sensitive Details: We cover practical strategies to mask, restrict, or generalize sensitive records so that autonomous agents see only the exact pieces of information necessary to complete their tasks, and no more.

Built-In Security Defaults and Digital Accessibility

Together, inherited security and accessible design make sure that headless solutions remain both robustly protected and broadly usable.

• Inherited Security: Headless interactions apply Salesforce’s user permissions, field-level security, and audit trails, limiting external AI tools to existing human authorizations.

• Designing for Digital Accessibility: When we move beyond the traditional browser page, we must also make sure that the new custom apps and channels are accessible and still provide the best possible experience for all users.