You are here:
DevOps Center Governance Policies
Governance includes six predefined policies that cover the most critical security and code quality risks in AI-assisted Salesforce development. All policies are Salesforce-defined and apply org-wide. You can turn each policy on or off, but you can't create or edit policy definitions.
Each policy targets a specific risk area. When you turn on a policy, it takes effect across your entire org immediately. No additional configuration is required in Agentforce Vibes.
| Policy | Description | Default Status |
|---|---|---|
| No SOQL/SOSL Injection | Prevents dynamic SOQL/SOSL queries that concatenate user input without escaping, to
prevent injection attacks. Guides coding agents to use bind variables (:variable)
or String.escapeSingleQuotes() for all dynamic query values. |
On |
| Enforce CRUD/FLS Checks | Requires object- and field-level security checks before all DML and SOQL operations to
prevent unauthorized data access (CWE-862/863). Guides coding agents to use
WITH USER_MODE (API v56+) or
Schema.describeSObjectResult checks for CRUD and FLS
validation. |
On |
| No Destructive Commands | Prevents bash commands that contain destructive patterns — such as
rm -rf, DROP TABLE, or TRUNCATE —
before execution. Applies to all bash commands executed by Agentforce Vibes
coding agents. |
On |
| No Direct Deployments to Production | Prevents any attempt to deploy metadata directly to a production org. All changes must go through the DevOps Center pipeline. Guides coding agents to use approved promotion gates — such as code review and validated test runs — before reaching production. | On |
| No Hardcoded Salesforce IDs | Detects hardcoded 15- or 18-character Salesforce record IDs in Apex, LWC, and metadata files. IDs break when migrated across environments. Guides coding agents to use Custom Metadata Types, Custom Settings, or SOQL queries to retrieve IDs dynamically instead. | On |
| New Objects and Fields Require Descriptions | Enforces that every new custom object and field has a non-empty description. Guides coding agents to add descriptions that meet a minimum length of 10 characters, improving metadata discoverability and long-term maintainability for future developers. | On |
- Access Policy Controls
Open Policy Controls to view the predefined policies available in your org and their current status. - Manage Policy Controls
Turn policies on or off to control what Agentforce Vibes coding agents are permitted to do across your org.
Hjalp denne artikkelen med å løse problemet ditt?
La oss få vite det slik at vi kan forbedre!
