Observe is on the list and explain is not
Salesforce's post on its six-part model for enterprise AI puts an AI Control Plane over everything else. The post says the control plane will let companies discover and register agents and AI capabilities, establish identity and policy, manage lifecycle, evaluate performance, observe behaviour and outcomes, and control cost across Salesforce and third-party AI. Explaining why an agent did something is not one of them, and the word audit does not appear either.
Observing an outcome and explaining an action are different jobs. Our sibling piece argues that shared context is where an agent's boundary gets drawn. This one stays on the record. A control plane can see that a credit was issued. The finance lead asks which agent issued it, under which permission, through which tool, and on what basis, and each of those is a fact the platform wrote down at the time or lost.
Five facts a finance lead will ask for
Here is the meeting. A service agent built in Agentforce issued a goodwill credit that finance did not budget for, and the finance lead wants to know why before the month closes. Which agent, since several are registered against Service Cloud. Which policy allowed a credit of that size, and which version was live at the time. Which tool wrote it, with what inputs. Which model planned a credit over a callback. And what the agent had read about the customer when it decided.
The post's own vocabulary covers each of those five somewhere. Identity and permissions sit under Trusted Security. Lineage sits under Trusted Governance. State and memory sit under Trusted Agency. Model routing sits under Trusted Models, which the post says picks a model on accuracy, performance, cost, and business requirements. What the post does not describe is one record, keyed to one action, that holds all five. Four owners each holding a fifth of the answer will not satisfy whoever signs off the credit memo.
Deterministic controls are the easy part to explain
The post says Trusted Agency combines flexible AI reasoning with deterministic controls where certainty is required. A deterministic control produces its own explanation. The flow ran, the validation rule fired, the approval step was skipped because the amount sat under the limit. Any admin can reconstruct that from run history.
The flexible reasoning leaves no history unless someone builds it. The plan the agent formed, the alternatives it weighed, the step where it settled on a credit, none of that lands in a standard object. So the line between deterministic and flexible needs writing down per action type, because everything on the flexible side needs a record the platform has not yet promised. We made the same argument about a durable process record beneath process-first agents when Microsoft showed its version at PPCC. The vendor changed and the requirement did not.
Third-party agents tend to arrive as integration users
The post says the control plane spans Salesforce and third-party AI, and it names Claude, Slack, and Microsoft Teams. Shawn Malhotra, CTO at Rocket Mortgage, is quoted saying "We don't want to bet our future on one closed stack". It also means an action can start in a Slack thread, be planned by a model outside Salesforce, and land as an API call through MuleSoft, and at each hop the actor's identity can get swapped for a generic one.
In most orgs we have looked at, the generic one is an integration user, and an integration user explains nothing. Registration in the control plane only helps if the identity assigned there is the identity stamped on the API call at the bottom of the stack. ServiceNow's AI Gateway raised the same question from the enforcement side, and we sorted which agent rules belong at the gateway and which stay in ACLs. We would ask Salesforce whether a registered identity survives a hop into Teams and back.
Cost control is almost the record you need
Control cost is the last job on the list, and it is the one most likely to force the record into existence. Cost control across Salesforce and third-party AI means metering, and metering means a per-call entry that says which agent called which model through which route, and when. That entry lacks the policy version and the inputs, but it already has the actor, the model, and the time.
Ask your account team whether the cost ledger and the audit record are the same record. Two ledgers that nearly agree are worse than one. Rohan Kumar, Salesforce's president and chief platform and engineering officer, is quoted on an enterprise's "ability to securely turn that context into action". Securely is carrying a lot in that sentence. The post names Salesforce Guardian and Agent Fabric among the technologies involved and does not say which holds the record that would prove it.
Reconstruct one action before the roadmap ships
On timing, the post says many of the foundational technologies are available now, with new capabilities and a unified experience planned for early fiscal 2028, and that packaging, pricing, and upgrade paths will be announced closer to general availability. Salesforce's fiscal year runs ahead of the calendar, so we read that as early 2027. The post gives no month.
That leaves time for one exercise. Pick an action an agent took in your org during the week of August 31, 2026, a case closure, a discount, a field update. Give a colleague who was not involved thirty minutes and ordinary reviewer access, and ask them to write down who acted, under what permission, through which tool, with what inputs, and which model planned it. Note every place they had to ask a person instead of reading a record. Those gaps are your requirements for the control plane, and they belong in the agent readiness check now. If your colleague comes back with two answers out of five, you know exactly what to ask Salesforce for.
