Salesforce Einstein, Agentforce, or custom CRM AI?

"Salesforce Einstein" can mean lead scoring, prediction, generated text, a trust layer, or the product that Salesforce now calls Agentforce. Those are different systems with different jobs.

Start with the business decision. Then choose the smallest Salesforce AI architecture that can make or support it safely. Sometimes that is a native predictive feature. Sometimes it is Prompt Builder inside a Flow. An agent is useful when a person needs a conversation across several questions and actions. Custom code earns its place when the boundary has to be deterministic.

Start by untangling the names

Salesforce renamed Einstein Copilot for Salesforce to Agentforce beginning in 2025. Salesforce still uses the Einstein name for other capabilities, including the Einstein Trust Layer and established predictive features. Its documentation warns that old and new terms can appear together during the transition.

The current Salesforce documentation also calls the units formerly known as agent topics subagents. Product names will keep moving. Design around capabilities:

Salesforce's Agentforce design documentation and developer overview are the current sources for product names and supported building blocks.

Choose the architecture from the job

Use a predictive feature when the output is a score based on historical patterns and the packaged feature matches the population, data volume, and action you need. Lead propensity is the obvious example. You still need to validate which records make up the training and scoring populations, what the score is allowed to trigger, and how Sales interprets it.

Use Prompt Builder when one bounded interpretation or generation belongs inside an existing Salesforce workflow. Salesforce documents prompt templates that can use record fields, related lists, Flow, and Apex-supplied context. A qualification explanation, account summary, or first-draft email can fit here.

Use Agentforce when the user needs a conversational surface that can select among several questions and actions. A seller asking "why is this opportunity stuck?" and then "draft the follow-up" is working across retrieval, interpretation, and action.

Use custom Apex or an external service when a hard control, complex orchestration, portable model, cross-system workflow, or cost requirement falls outside the native feature. Custom does not have to mean replacing Agentforce. An Agentforce action can call Flow, Apex, or a prompt template, so the native agent can sit on top of custom business logic.

Native and custom are layers, not opponents

The most useful Salesforce AI systems combine layers:

Lightning or Agentforce interface
  -> business question or approved action
  -> context and guidance retrieval
  -> Flow or Apex control boundary
  -> prompt, model, or deterministic rule
  -> structured result and explanation
  -> approved record update or next action
  -> history, feedback, and monitoring

The agent handles conversation and action selection. Salesforce permissions constrain the user and records. Apex or Flow enforces the business boundary. A prompt interprets the evidence. An append-only history explains what happened later.

Choosing one vendor feature does not remove the need for the other layers.

Put business context outside the giant prompt

Salesforce knows the schema and the values. It does not automatically know which custom field is authoritative, which records your company excludes from pipeline, or what your team means by "qualified."

Store those definitions as maintained data. A custom guidance object can hold:

• the objects and fields an AI action may read;
• business definitions and exclusions;
• source, authority, and freshness rules;
• rule dependencies and precedence;
• owners, versions, effective dates, and review dates;
• literal filters for deterministic reporting rules.

At runtime, retrieve only the rules relevant to the question. This is the Salesforce context-layer pattern. It keeps the working guidance editable by RevOps and keeps prompts from becoming the only copy of business policy.

Enforce permissions and policy in code

A prompt instruction is a soft control. If an agent may query only approved objects and fields, validate the final query plan in Apex and use normal Salesforce CRUD, field level security, sharing, and permission sets underneath it.

The model may suggest an action. The deterministic layer decides whether the action is permitted.

This distinction matters for:

• reading sensitive or irrelevant fields;
• changing ownership, stage, or qualification;
• sending customer communication;
• merging or deleting records;
• exposing generated output to another automation;
• calling an external provider with CRM data.

Salesforce states that Agentforce respects standard access controls and integrates with the Einstein Trust Layer. Those platform protections do not define your business meaning or decide which legal fields are appropriate for a particular answer.

Design actions as contracts

Salesforce's current Agentforce action model can call Apex, Flow, or a prompt template. The action description helps the model decide whether to call it, while the executable target performs the work. Salesforce also supports requiring user confirmation for an action.

Use a narrow contract:

name: qualify_inbound_request
input:
  record_id: LeadOrContactId
preconditions:
  - handraiser_evidence_present
  - qualification_not_already_final
  - consent_and_suppression_checked
output:
  qualification: enum
  explanation: string
  evidence_ids: string[]
  needs_review: boolean
side_effects:
  - write_qualification_result
  - append_decision_history
forbidden:
  - send_email
  - convert_lead
  - assign_owner

Keep sending, conversion, and ownership in later actions with their own permissions and confirmation policy. One giant action is hard to test and gives the reasoning layer too much authority.

Salesforce's Agent Script action reference documents the current targets and confirmation option.

Keep lead scoring understandable

Salesforce AI can contribute to lead scoring without owning the whole number.

Use deterministic fields for known company size, target-account status, geography, consent, and hard exclusions. Use AI where somebody must interpret a job title, submitted message, use case, or likely persona. Preserve fit and intent components, then give Sales one combined score with a stable meaning.

The lead-scoring system Reference covers the model, decay, enrichment, overrides, and calibration. The same logic applies whether the final field is written by Flow, Apex, a managed Salesforce feature, or an external service.

Decide when the agent may act

Read-only answers are a smaller risk than record changes. Add autonomy step by step:

1. Answer from approved records and cite what was used.
2. Recommend an outcome with an explanation.
3. Draft a message or proposed update.
4. Queue the action for review.
5. Act automatically inside explicit limits.

Use confirmation for consequential or ambiguous actions. Add volume and spend caps, per-record cooldowns, staged rollout, a kill switch, and a durable job history before automatic action reaches the whole organization.

The CRM AI permissions Reference and production-readiness checklist cover the control set.

Test the business behavior, not the demo

A convincing agent demo proves the happy path. Production testing needs records that exercise the boundary:

• the correct Account with a stale field;
• a user who can see the record but not the sensitive field;
• a question whose answer requires an object outside the allowlist;
• conflicting guidance rules;
• an action called twice;
• a model timeout after a downstream job starts;
• an old recommendation whose source data changed;
• a generated field being cited as if it were observed fact.

Store the prompt or action version, evidence identifiers, result, final human decision, override reason, and timing. That history lets RevOps tell the difference between a bad model answer, a stale business rule, missing CRM data, and a workflow failure.

A practical selection guide

Start with the smallest useful vertical slice. Add an agent when conversation and action selection improve the work. Add custom code when it creates a boundary you can test. The product name should be the last decision, not the first.