# Securing service data: sharing, encryption and Trust Layer

*Agentforce Service Consultant Study Guide · Agentforce Service Solution Design · Last updated October 15, 2026 · https://www.certifyforce.com/study-guide/agentforce-service-consultant/agentforce-service-solution-design/securing-service-data-sharing-encryption-and-trust-layer*

Match each service security requirement to the control that meets it: case OWD, queues, sharing rules and case teams; external OWD and sharing sets; field-level security, muting and login IP ranges; Shield Platform Encryption, Event Monitoring and Field Audit Trail; and the Einstein Trust Layer and agent user for Agentforce Service agents.

- Certification: Salesforce Agentforce Service Consultant
- Exam section: Agentforce Service Solution Design
- Study guide: https://www.certifyforce.com/study-guide/agentforce-service-consultant

**Official exam objective:**

> Given a set of customer data security and compliance requirements, determine a successful design to secure the data.

## What the exam expects

- Design case record access with OWD, the role hierarchy, queues, sharing rules and case teams, and external access with external OWD and sharing sets.
- Restrict fields and logins with field-level security, muting permission sets, login IP ranges and login hours.
- Choose Shield Platform Encryption, Event Monitoring or Field Audit Trail for an at-rest or audit requirement, and explain encryption trade-offs.
- Explain which Einstein Trust Layer services protect Agentforce Service agents, and how the agent user limits what an agent can surface.
- Design for data minimization and erasure across cases and messaging transcripts.

Key terms:
- **OWD:** the default, most restrictive record access; other tools only widen it.
- **Sharing set:** grants Experience Cloud users access to records tied to their account or contact.
- **Muting permission set:** switches off chosen permissions inside one permission set group.
- **Agent user:** the EinsteinServiceAgent user whose access governs what a Service agent can read.
- **Zero data retention:** third-party models keep no data and train on none.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Sharing rules | Only widen access; never stricter than OWD | [Sharing Rules](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_sharing_rules) |
| Queue take-ownership | Requires Edit on cases; Modify All Data takes from any queue | [Assign Cases](https://help.salesforce.com/s/articleView?id=service.cases_assign.htm&language=en_US&type=5) |
| External OWD | Can't be more permissive than internal OWD | [External OWD](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&type=5) |
| Sharing sets | One sharing set per profile | [Sharing Set](https://help.salesforce.com/s/articleView?id=sf.networks_setting_light_users.htm&type=5) |
| Muting | Up to one muting permission set per permission set group | [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5) |
| Encrypted fields | Not allowed in criteria-based sharing rules | [General Shield Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&language=en_US&type=5) |
| Existing records | Encrypted only after an encryption sync | [Turn On Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_turn_on_fle.htm&language=en_US&type=5) |
| Field Audit Trail | Up to 200 fields per object; API access only | [Field Audit Trail](https://help.salesforce.com/s/articleView?id=xcloud.field_audit_trail.htm&language=en_US&type=5) |
| Agent masking | Data masking disabled for agents | [Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&language=en_US&type=5) |
| Agent dataspace | Data 360 connection works only with the default dataspace | [Considerations for Agentforce Service Agent](https://help.salesforce.com/s/articleView?id=ai.service_agent_considerations.htm&language=en_US&type=5) |
| Agent user default | Minimal access; internal OWD applies | [Configure Service Agent Access](https://help.salesforce.com/s/articleView?id=ai.agent_user.htm&language=en_US&type=5) |

## Check yourself

- Why can't an encrypted Region field drive a criteria-based sharing rule?
- When does turning on field encryption protect records that already exist?
- Which Trust Layer service is disabled for Agentforce Service agents?
- Who can take a case from a queue they don't belong to under Private OWD?

## Sources

- [Configure Service Agent Access](https://help.salesforce.com/s/articleView?id=ai.agent_user.htm&language=en_US&type=5)
- [Considerations for Agentforce Service Agent](https://help.salesforce.com/s/articleView?id=ai.service_agent_considerations.htm&language=en_US&type=5)
- [Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&language=en_US&type=5)
- [Enhancing Data Security in Salesforce (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_overview)
- [Improve Data Security with Sharing Rules (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_sharing_rules)
- [Improve Field-Level Security Settings (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_fields)
- [Assign Cases](https://help.salesforce.com/s/articleView?id=service.cases_assign.htm&language=en_US&type=5)
- [What's a Case Team?](https://help.salesforce.com/s/articleView?id=service.caseteam_def.htm&language=en_US&type=5)
- [External Organization-Wide Defaults Overview](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&type=5)
- [Create a Sharing Set for Experience Cloud Site Users](https://help.salesforce.com/s/articleView?id=sf.networks_setting_light_users.htm&type=5)
- [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5)
- [Restrict Login IP Addresses in Profiles](https://help.salesforce.com/s/articleView?id=sf.login_ip_ranges.htm&type=5)
- [Get to Know Shield Platform Encryption (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/shield-platform-encryption-quick-look2/get-to-know-shield-platform-encryption2)
- [General Shield Platform Encryption Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&language=en_US&type=5)
- [Turn On Encryption for Standard and Custom Fields](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_turn_on_fle.htm&language=en_US&type=5)
- [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5)
- [Field Audit Trail](https://help.salesforce.com/s/articleView?id=xcloud.field_audit_trail.htm&language=en_US&type=5)
- [Protect Customer Data and Privacy in Messaging](https://help.salesforce.com/s/articleView?id=service.livemessage_privacy.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Agentforce Service Consultant pack (USD $19): https://www.certifyforce.com/practice-exams