On October 12, Salesforce's API Catalog reached general availability as part of the Winter '27 release. Announced on August 31, it turns agent access control into a product: one managed surface that decides which agents may call which commerce APIs, and which Model Context Protocol (MCP) servers and tools they may reach. APIs and MCP servers from MuleSoft, Heroku, and Apex now consolidate into a single administered catalog.
If you run agents against a Salesforce org, this is the most consequential governance change of the quarter. It is also easy to misread. A catalog is an enforcement point. It is not a governance program. Here is the difference, and what to do about it.
What the API Catalog actually gives you
- One place to see the APIs and tools agents can reach, instead of permissions scattered across MuleSoft, Heroku, and Apex.
- The ability to activate Salesforce-hosted MCP servers for outside clients, and to register external MCP servers alongside them.
- Allowlist semantics as a setting inside the CRM subscription — an admin decision, not a custom build.
That last point matters. Until now, limiting what an agent could touch meant integration-layer work: gateway rules, named credentials, wrapper APIs. Making it a setting collapses the cost of saying no. Teams that postponed agent scoping because it was an engineering project can no longer use that excuse.
What it does not give you
The catalog answers the question of what this agent can reach. It does not answer the questions that decide whether an agent program survives contact with production:
- Who decides what belongs on the allowlist, and against what criteria?
- Who owns a change to the list — and is that change reviewed like a code deploy or clicked like a report filter?
- How do you verify the agent behaves inside its limits before customers meet it, and re-verify after every release?
- When an agent does something wrong inside its allowed surface, who is accountable — and how fast do you know?
Coverage of the release carries the telling number: only 28% of merchants are willing to offer agents their full product range. Salesforce also reports early results for the companion Agentic Commerce Search — a 13% conversion lift and a 17% increase in add-to-cart rates — though those are vendor-reported figures with no independent test data published yet. Read both numbers together and the picture is clear: the upside is real enough to pursue, and buyers still do not trust agents with the whole store. The gap between those two facts is governance, not tooling.
The operating practice to build around the setting
- 01Treat the allowlist as code. Every addition gets an owner, a written justification, and a review. Every removal gets a date. An allowlist nobody prunes becomes an allow-everything list within two quarters.
- 02Scope by task, not by team. An agent that drafts order updates does not need the returns API because the commerce team owns both. Smallest surface that completes the task, nothing else.
- 03Test the boundary, not just the behavior. Your test suite should include attempts to use what the agent is not allowed to reach — and should fail the release if the attempt succeeds quietly.
- 04Log decisions where auditors can find them. The catalog logs calls. You still need a record of why each entry exists. A one-line rationale per entry is cheap the day you write it and expensive to reconstruct the day a regulator asks.
- 05Re-certify on every release. Winter '27 changed the control surface itself. Anything you validated before October 12 was validated against a different system.
Where we stand
We run AI agents on our own operations and hold the same line there that we recommend to clients: scoped access, reviewed changes, human-tested releases. Our team of 69 consultants holds 221 Salesforce certifications, 56 of them Agentforce-specific, and the pattern across every engagement since 2019 is consistent — the orgs that win with agents are the ones that treat access decisions as owned, reviewed, and tested, not configured once and forgotten.
If you are turning on the API Catalog this quarter and want a second set of eyes on the operating practice around it, our fixed-scope Salesforce reviews exist for exactly this.