Platform
The Trusted Enterprise AI Harness: six capabilities, and which product does each today
Salesforce announced the Trusted Enterprise AI Harness the week before Dreamforce as six capabilities every agent needs, with a unified experience arriving in early fiscal 2028. Most of the six are products you already own under a new diagram. This post maps each capability to what does the job in your org today, what is still a roadmap, and how to use the six as an inventory rather than a purchase.
The word Harness did a lot of work at Dreamforce. Salesforce announced the Trusted Enterprise AI Harness on September 10, five days before the keynote, and by the Tuesday it was the frame for nearly every product on stage.
A CIO who watched the keynote will ask an architect a simple question the following week: are we buying the Harness? The answer is that most of it is already in the org, one part is a 2027 roadmap, and the useful thing to do with the announcement is to treat its six capabilities as an inventory. This post goes through them one at a time and names the product that does each job today.
What Salesforce says the Harness is
Salesforce’s definition is a foundation architecture that lets agents understand customers and business context, reason about decisions, act across systems, and operate within enterprise controls, either as one composable system or as separate parts. The parts are six capabilities, each with the word Trusted in front: Context, Agency, Action, Governance, Security and Models.
The source technologies are listed in the same story: Data 360, Informatica, MuleSoft and Agent Fabric, Tableau, Agentforce, Salesforce Guardian and the Salesforce Platform. On top sits an AI Control Plane for discovering and registering agents, setting identity and policy, managing lifecycle, evaluating performance, observing behaviour and controlling cost.
The availability line is the one to read twice. Salesforce says many of the underlying technologies are available today, with new capabilities and the unified experience planned to begin rolling out in early fiscal FY28. Salesforce’s fiscal 2028 starts in February 2027. I covered the Control Plane’s roadmap status already. Below is the rest of the diagram.
Trusted Context
The definition: customer data, metadata, semantics, knowledge, signals, memory and workflow understanding, grounded in governed enterprise data.
What does this today is Data 360. Unified profiles are the customer data, zero copy is how warehouse tables become context without a copy, and Intelligent Context is how a PDF or a contract becomes something an agent can retrieve. Informatica supplies the catalog and lineage for data that lives outside Salesforce. Tableau Semantics is the part that says what “revenue” means so two agents do not compute it differently.
The gap in most orgs is not the product but the semantics. If nobody has written down which field is the customer’s real email or which number is ARR, the context layer will faithfully serve the ambiguity. That work is configuration, not procurement.
Trusted Agency
The definition: reasoning, planning, state management, memory, collaboration and orchestration, combining flexible AI reasoning with deterministic controls.
Today that is the Atlas reasoning engine inside Agentforce, the topics and subagents you design in Builder, and Agent Script for the deterministic half. The long-horizon runtime that Hunter runs on is the memory and state part, and multi-agent orchestration went generally available in September. Nothing here is waiting for 2027.
What changed at Dreamforce is the model underneath the reasoning, not the reasoning layer itself. Koa is in pilot, Gemini is generally available in the engine, and that belongs under Trusted Models below.
Trusted Action
The definition: connecting AI to applications, APIs, workflows, tools and business processes so it can execute and return outcomes.
In an Agentforce org that is Flow, invocable Apex, prompt templates and standard actions. Across systems it is MuleSoft APIs, MCP tools for anything that exposes a server, and A2A for delegating to an agent on another platform. The Harness adds no new action type. It names the ones you have.
The design question worth asking under this heading is which identity each action runs as. An action that runs as the user inherits their permissions. One that runs as an integration user inherits whatever that user was given years ago. The Harness diagram does not fix that. Your permission review does.
Trusted Governance
The definition: governing data, metadata, policies and processes with lineage, quality, guardrails and controls.
This is the capability with the biggest gap between the diagram and the shelf. Informatica handles lineage and data quality for the data estate. MuleSoft Agent Fabric is the registry for agents, including ones you did not build on Salesforce, and it exists today. The policy layer that spans all of them, which is what the Control Plane promises, is the FY28 item.
The interim answer is the one I gave in the Control Plane post: build the registry yourself. Every agent, an owner, a scoped identity, what it can touch, a retirement date. When the unified experience arrives, an org with that spreadsheet imports it. One without it starts from zero under deadline.
Trusted Security
The definition: identity, permissions, privacy, data protection and runtime security applied to what AI can access and what agents may do.
Almost all of this exists and is old. Sharing rules, field-level security and profiles decide what an agent’s user can see. The Einstein Trust Layer masks data before it reaches a model and enforces zero data retention with the providers. Shield adds event monitoring, and Data Detect finds the sensitive text in fields before an agent grounds on it.
One name in Salesforce’s list needs care. The Harness story names Salesforce Guardian as a source technology. Salesforce’s own security site describes Guardian as the family of add-on security and privacy products you buy on top of a licence, Shield among them. Some Dreamforce coverage went further and called Guardian the new name for the Trust Layer.
I could not find a press release or documentation page that says so. Until Salesforce does, treat Guardian as the security product family and the Trust Layer as the Trust Layer.
Trusted Models
The definition: connecting models flexibly and securely, with intelligent routing based on accuracy, performance, cost and requirements.
The first half exists. Agentforce has a model menu with Claude, Gemini now generally available in the reasoning engine, a bring-your-own path through Model Builder, an AWS-hosted lane through Bedrock, and Koa in pilot for CRM actions with general availability expected in winter in US regions.
The second half is the part to watch. Routing a request to the cheapest model that can do it accurately is described in the Harness. What you can configure today is selection, at the org level, and per subagent where the builder allows it. Nothing I have read describes automatic routing shipping before the unified experience. If a vendor slide implies you can turn it on now, ask which setting.
The one table you need
Six rows, three columns.
| Capability | Does the job today | Still a date |
|---|---|---|
| Trusted Context | Data 360 (profiles, zero copy, Intelligent Context), Informatica catalog, Tableau Semantics | Unified semantic experience |
| Trusted Agency | Atlas, topics and subagents, Agent Script, long-horizon runtime, orchestration | Nothing material |
| Trusted Action | Flow, Apex, prompt templates, MuleSoft, MCP, A2A | Nothing material |
| Trusted Governance | Informatica lineage and quality, Agent Fabric registry, your own inventory | AI Control Plane, early FY28 |
| Trusted Security | Permissions and sharing, Trust Layer, Shield, Data Detect | Agent identity beyond the user (described, not dated) |
| Trusted Models | Org-level model selection, BYO model, Bedrock lane, Koa pilot | Automatic routing |
Read down the middle column and you have the shopping list for a Harness that is mostly already paid for. Read down the right column and you have the roadmap, and it is short.
Use the six as an inventory
The practical value of the announcement is that it gives you a checklist with Salesforce’s name on it, which is easier to put in front of a steering committee than one with yours.
Take each capability and ask three questions of your own org. Which product does it today. Who owns the configuration. What is the one gap. For most orgs the gaps cluster in two places: semantics under Context, because nobody has written the definitions, and identity under Action and Security, because the integration users predate the agents. Neither waits for 2027 and neither costs a licence.
Then decide what to do with the Control Plane date. My advice is to plan as if it arrives in the second half of 2027 with a price you do not yet know, and to build the registry discipline now so the arrival is an import rather than a project.
Understanding the basics
What is the Trusted Enterprise AI Harness?
Salesforce’s name, announced on September 10, 2026, for the architecture it says every enterprise agent needs: six capabilities called Trusted Context, Agency, Action, Governance, Security and Models, drawn from Data 360, Informatica, MuleSoft and Agent Fabric, Tableau, Agentforce, Salesforce Guardian and the Salesforce Platform. It is a framing of existing and planned products rather than a single new one.
Can I buy the Enterprise AI Harness?
Not as one item. Salesforce says many of the underlying technologies are available today and that new capabilities and a unified experience begin rolling out in early fiscal FY28, which starts in February 2027. Pricing and packaging for the unified experience have not been published.
What is the difference between the Harness and the AI Control Plane?
The Harness is the six-capability architecture. The AI Control Plane is the management layer on top of it, for registering agents, setting identity and policy, and observing performance and cost across platforms. The Control Plane is the part with the FY28 date.
Is Salesforce Guardian the new name for the Einstein Trust Layer?
Salesforce has not said so in a press release or documentation I could find. Its security site describes Guardian as the family of add-on security and privacy products. Some coverage has described a rename, so check the source before repeating it.
The diagram is worth more than the wait
Every platform vendor now has a diagram like this, and most of them exist to sell the box at the top. Salesforce’s is unusual in that five of the six rows are things a mature org configured years ago under other names.
That makes the announcement a gift to whoever runs architecture: a vendor-endorsed list of the six places to look, with the answer already sitting in your org for most of them. Fill in the table for your own estate this month. The Control Plane can arrive when it arrives.
If you want the six capabilities mapped against your own org, with the semantic and identity gaps named before a steering committee asks, talk to us, or start with the org health scorecard.
