Agentforce Coworker is the AI teammate Salesforce embedded beside Global Search in Lightning — an “Ask” button that answers plain-language questions across CRM, Slack, Data 360, and 300+ connected enterprise sources, and routes work to other agents. Salesforce declared it generally available on August 4, 2026, and on August 10 began enabling it automatically, on a rolling basis, for orgs with Unmetered User-Based AI seats. Its entire governance story fits in one line from the September announcement: every request runs on the user's existing permissions and business rules — no migration, “no new permissions model.” That line is the product's best feature and its sharpest risk, because Coworker does not widen what any user is allowed to see. It widens what they can find. Every over-granted field, every stale sharing rule, every profile that accumulated access through a decade of just-make-it-work tickets becomes conversationally discoverable the moment the Ask button goes live. This piece covers what permission inheritance actually does, what the zero-data-retention claim does and does not protect, and the audit to run before enablement — or today, if enablement already happened without you.
Switched on, then announced
The activation mechanics matter because many admins never performed them. Salesforce's own help FAQ confirms that auto-enablement began August 10, 2026 for orgs holding Unmetered User-Based AI seats, excluding HIPAA, health, and government clouds, multi-dataspace orgs, and orgs that had disabled generative AI features. The opt-out lives at Setup → Agentforce Coworker → Opt Out of Auto Activation, and the feature can be disabled any time — but both actions assume an admin knows there is something to opt out of. Five weeks later at Dreamforce, Salesforce announced that 100,000 users had activated Coworker in its first 35 days. The arithmetic is worth doing: 35 days back from September 15 is August 11, so the celebrated adoption window begins the day after documented auto-enablement started rolling. No source defines whether “activated” means a person chose the feature or a rollout reached them, and as one critical analysis noted, the statistic ships without a denominator in an installed base counted in millions of seats.
The design bet: inheritance
Permission inheritance is a genuinely good engineering decision. Coworker conforms to profiles, permission sets, and sharing rules exactly as configured; if a user cannot see a field through the UI, Coworker will not reveal it. Nothing to migrate, no parallel access model to maintain, no second system of record for authorization. The problem is the thing being inherited. Most production orgs more than a few years old carry permission debt — field-level security that was never tightened after a project shipped, sharing rules built for a reorg two reorgs ago, profiles cloned from admin templates. Before Coworker, that debt was latent: finding an over-granted field meant knowing which tab, which related list, which report to open. A conversational interface removes the tab. The access was always there; the discovery cost just dropped to a sentence. Salesforce is making the same bet platform-wide: Builder Central, the no-code workspace in beta since September 14, promises that apps and agents built by business users automatically inherit existing user permissions and org configuration. Inheritance is now the default authorization story for everything Salesforce ships — which makes the state of your permission model the single input that decides whether these launches are safe in your org.
Coworker doesn't widen access. It widens discovery — every over-grant from the last decade is now one question away.
Zero data retention protects you from the vendor, not from your org
The announcement's second reassurance is that business data is used to answer the question at hand and not retained. Read Salesforce's own Agentforce privacy FAQ and the claim acquires three carve-outs: data may be retained for trust-and-safety review, some third-party model providers retain data for a limited period — around 30 days — for system monitoring, and Salesforce-internal audit logs retain data for security and compliance. Which large language model actually powers Coworker is not disclosed anywhere we could find. Those caveats are defensible engineering; the point is that zero data retention answers a question most orgs were not asking. The realistic threat is not the model provider warehousing your pipeline — it is what a credentialed insider, or an attacker who reaches one, can now ask. Nine days after the Dreamforce adoption stat, Zenity Labs disclosed SalesBleed: three Agentforce flaws including zero-click CRM exfiltration through prompt injection planted in Web-to-Lead records, exfiltration via Slack URL unfurling, and an action that let an agent send Slack messages under its trusted identity without user approval. All three were fixed before disclosure — reported June 1, remediated August 19 through September 21. But the Web-to-Lead injection class is a repeat: ForcedLeak, disclosed September 2025 at CVSS 9.4, used the same entry point. The same vector recurring two years running says the injection surface, not the retention policy, is where attention belongs.
Meanwhile, the governance tooling arrives after the agents
The sequencing across Salesforce's fall releases tells its own story. Winter '27 — live in production since the October 3 and 10 go-live waves — auto-enables the Agentforce platform itself for eligible editions, and removes the master toggle later in the release, leaving the Einstein Setup switch, per-agent activation, and the Manage AI Agents permission as the remaining controls. That is separate from, and broader than, Coworker's August rollout. Then on October 27, Salesforce expanded MuleSoft Agent Fabric with an Agent Kill Switch, a FinOps Dashboard, Model Wallet budget limits, and federated governance policies spanning Azure, Apigee, and Kong gateways — with Agent Evals entering beta in November and targeting general availability in January 2027. The control plane is real and welcome. It is also arriving months after the enablement waves, and the evaluation layer lands next quarter. If you wait for the vendor's governance stack to mature before auditing your own org, the agents will have been live for two quarters first.
The pre-enablement audit (run it post-enablement if you must)
- 01Check whether Coworker is already on. Auto-enablement has been rolling since August 10 — look for the Ask button, and decide deliberately at Setup → Agentforce Coworker rather than by default.
- 02Audit permission debt before the conversational interface exposes it: field-level security on sensitive objects, sharing rules nobody owns, profiles that accumulated access. This is the audit; everything else is configuration.
- 03Review who holds the Coworker permission sets — Agentforce Coworker Admin, and the user permission set group. Auto-enablement granted eligible users automatically; people added later need manual provisioning, which means the holder list drifts.
- 04Scope external sources deliberately. Google Drive and SharePoint permission changes take up to an hour to propagate to Coworker's index, and removed files linger in results during the window. Connect sources one at a time, not all 300.
- 05Put credit burn on a leash. CRM and Slack search is free only on eligible unmetered seats; Data 360 answers and custom index builds consume Flex Credits, and misconfigured user-based AI permissions can make seat-licensed users burn credits wrongly. Watch the Digital Wallet from day one.
- 06Turn on audit instrumentation before users start asking questions — Einstein Feedback and Monitoring toggles, plus the generative AI audit dashboard in Data Cloud. Note the gap: there is no Coworker-specific audit documentation. Name it in your risk register.
- 07Harden the injection surface SalesBleed exposed: treat Web-to-Lead and every externally writable record as untrusted agent input, verify Trusted URLs enforcement, and audit any agent action that can send messages without human approval.
- 08Treat Winter '27 as a separate event. The platform-wide auto-enablement has its own timeline and its own shrinking set of controls — audit who holds Manage AI Agents the way you audit Modify All Data.
- 09Have legal confirm which terms govern. Coworker enablement historically required accepting Beta Services Terms, and Salesforce's own developer docs still carried beta labels months after the GA announcement.
This checklist is the fixed scope of the governance reviews we run: an inventory of what Coworker and every other agent in your org can currently read and reach, the permission and configuration changes that close the gaps, and the instrumentation to prove they stay closed. We run AI agents on our own operations under these controls, so the recommendations come from the operator's side of the table. If the Ask button appeared in your org before anyone decided it should, the audit is how you catch up to a decision that was made for you.