Agentforce Service Solution Design15% of the exam
Securing service data: sharing, encryption and Trust Layer
Match each service security requirement to the control that meets it: case OWD, queues, sharing rules and case teams; external OWD and sharing sets; field-level security, muting and login IP ranges; Shield Platform Encryption, Event Monitoring and Field Audit Trail; and the Einstein Trust Layer and agent user for Agentforce Service agents.
Given a set of customer data security and compliance requirements, determine a successful design to secure the data.
~8 min read · 17 practice questions ·
What the exam expects
- Design case record access with OWD, the role hierarchy, queues, sharing rules and case teams, and external access with external OWD and sharing sets.
- Restrict fields and logins with field-level security, muting permission sets, login IP ranges and login hours.
- Choose Shield Platform Encryption, Event Monitoring or Field Audit Trail for an at-rest or audit requirement, and explain encryption trade-offs.
- Explain which Einstein Trust Layer services protect Agentforce Service agents, and how the agent user limits what an agent can surface.
- Design for data minimization and erasure across cases and messaging transcripts.
Key terms:
- OWD: the default, most restrictive record access; other tools only widen it.
- Sharing set: grants Experience Cloud users access to records tied to their account or contact.
- Muting permission set: switches off chosen permissions inside one permission set group.
- Agent user: the EinsteinServiceAgent user whose access governs what a Service agent can read.
- Zero data retention: third-party models keep no data and train on none.
Key facts
Sharing rules
- Detail
- Only widen access; never stricter than OWD
Queue take-ownership
- Detail
- Requires Edit on cases; Modify All Data takes from any queue
External OWD
- Detail
- Can't be more permissive than internal OWD
Sharing sets
- Detail
- One sharing set per profile
Muting
- Detail
- Up to one muting permission set per permission set group
Encrypted fields
- Detail
- Not allowed in criteria-based sharing rules
Existing records
- Detail
- Encrypted only after an encryption sync
Field Audit Trail
- Detail
- Up to 200 fields per object; API access only
Agent masking
- Detail
- Data masking disabled for agents
Agent dataspace
- Detail
- Data 360 connection works only with the default dataspace
Agent user default
- Detail
- Minimal access; internal OWD applies
Sources for this section (11)
- Sharing Rulestrailhead.salesforce.com (opens in a new tab)
- Assign Caseshelp.salesforce.com (opens in a new tab)
- External OWDhelp.salesforce.com (opens in a new tab)
- Sharing Sethelp.salesforce.com (opens in a new tab)
- Muting Permission Setshelp.salesforce.com (opens in a new tab)
- General Shield Considerationshelp.salesforce.com (opens in a new tab)
- Turn On Encryptionhelp.salesforce.com (opens in a new tab)
- Field Audit Trailhelp.salesforce.com (opens in a new tab)
- Set up Einstein Trust Layerhelp.salesforce.com (opens in a new tab)
- Considerations for Agentforce Service Agenthelp.salesforce.com (opens in a new tab)
- Configure Service Agent Accesshelp.salesforce.com (opens in a new tab)
- Why can't an encrypted Region field drive a criteria-based sharing rule?
- When does turning on field encryption protect records that already exist?
- Which Trust Layer service is disabled for Agentforce Service agents?
- Who can take a case from a queue they don't belong to under Private OWD?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Agentforce Service Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Agentforce Service Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams