Salesforce is preparing to require external AI agents to register for their own platform identities, a change that will separate agent traffic from the human users and general-purpose integrations that many deployments rely on today.
The company is targeting November for the release of Agentic Identity, new security controls and a related billing model under its Headless Toolkit. Once the system is available, registered agents will receive distinct credentials and narrower permissions, while every successful call they make through a Salesforce API or Model Context Protocol server will be recorded as a Headless Platform Interaction, or HPI.
The price of those interactions remains unknown. Salesforce has added the HPI usage type to its Flex Credits framework, but the multiplier is still listed as “TBA.” Agentic traffic is not being metered yet, and the company says it will give customers 30 days’ notice before a numerical multiplier takes effect.
That leaves Salesforce admins with two jobs before a bill arrives: identify which integrations are actually agents, and replace shared or user-bound access with credentials and permissions designed for each agent’s real task.
Who will have to register an agent
The timetable depends on the customer and connection type. Customers purchasing Salesforce services on or after the publication of the company’s September guidance will have to register agents that use Salesforce APIs within three months of notice that Agentic Identity is available. Existing customers will move agents using APIs to the new model when they renew.
Connections to Salesforce MCP servers get a broader rule: Salesforce says every customer using one must register the agent within three months of notice. That can include external clients such as Claude, ChatGPT, Cursor or a custom agent that connects to a Salesforce-hosted MCP server.
Traditional integrations are not supposed to move to the new billing model merely because they call an API. Salesforce says their existing pricing and security options will remain in place, and that HPI metering is intended for agentic traffic. The difficult part for many organizations will be documenting where that boundary falls.
A nightly ETL job that copies records on a fixed schedule is a conventional integration. An assistant that decides which records to query, chooses a tool, retries an action and updates an opportunity after interpreting a user request is agentic. Workflows in the middle deserve review rather than an assumption based on the application’s marketing label.
What Agentic Identity changes
Salesforce’s current hosted MCP documentation describes per-user OAuth 2.0 authentication with PKCE. The connected AI client acts within the authenticated user’s existing sharing rules and field-level permissions. That is convenient, but it can also blur who initiated an action and give an agent access to everything its human operator can reach.
Agentic Identity creates a separate platform identity for the agent. Admins can assign a smaller permission set instead of lending it a human account. The resulting credentials also let Salesforce classify the connection as agent traffic, expose its activity in Digital Wallet and apply HPI billing when metering begins.
The identity model matters beyond accounting. An agent that only schedules customer meetings should not inherit permission to export every contact, delete campaigns or modify revenue forecasts. Dedicated credentials also give security teams a cleaner revocation path when an agent is retired, compromised or replaced.
Salesforce’s Winter ’27 developer tooling expands the surface these identities may govern. Agentforce agents can be exposed as tools on custom MCP servers, while Agentforce can call tools from registered MCP servers. The platform’s API Catalog can activate Salesforce-hosted servers and register external ones, and Agentforce Registry provides discovery information for servers published through AgentExchange.
How the new usage meter will work
Every successful request from a registered agent through MCP or a direct API will count as one HPI. Salesforce plans to track those events in Digital Wallet and deduct Flex Credits after the company publishes the multiplier.
Testing outside production gets an important exemption. Salesforce says sandboxes, scratch orgs and Developer Edition orgs will not incur HPI metering. Calls made by registered agents in active production orgs will be billable once the rate card is updated and the notice period ends.
Admins should not estimate future HPI cost using today’s Agentforce action pricing. Salesforce currently lists standard Agentforce actions at 20 Flex Credits, but that is a different usage type. The HPI multiplier could be lower, higher or structured differently. Any forecast made before the new rate appears is only a volume model, not a cost model.
It is still useful to count calls now. An agent that completes one business task with 18 reads, retries and record updates may create 18 billable interactions rather than one. Tool descriptions, pagination, polling, retry behavior and unnecessarily broad searches can all change the eventual cost without changing the visible outcome for a user.
A practical audit before November
- Inventory API and MCP clients. Start with connected apps, external client apps, integration users, named credentials, hosted MCP servers and custom agents. Record the owner, environment, authentication method, scopes and business purpose for each one.
- Classify the traffic. Separate deterministic integrations from systems that reason, choose tools or take multi-step action. Flag mixed applications that send both conventional API traffic and agent requests through the same credential.
- Measure calls per completed task. Capture successful calls, retries, polling and pagination in a representative production-like test. HPI metering is based on successful interactions, so a task-level average will be more useful than counting chat sessions.
- Design one identity per meaningful trust boundary. Do not put unrelated sales, support and marketing agents behind a single credential merely to simplify setup. Separate identities make permissions, logs, revocation and cost ownership easier to manage.
- Reduce permissions. Map every tool to the objects, fields and operations it needs. Prefer read-only access where possible, restrict high-impact writes and keep human approval around destructive or financially sensitive actions.
- Test in a nonbillable environment. Salesforce says sandboxes, scratch orgs and Developer Edition orgs will be exempt from HPI charging. Use that window to validate OAuth changes, callback URLs, token rotation and permission failures.
- Prepare budget controls. Enable a product that supports Flex Credits, assign cost ownership, and configure Digital Wallet alerts. Do not wait for a published HPI multiplier to discover that nobody owns consumption monitoring.
Questions Salesforce still needs to answer
The unannounced multiplier is the largest gap, but it is not the only one. Customers also need precise technical guidance for identifying agentic traffic in mixed applications, handling calls that fan out through middleware, and reconciling retries or partial failures with HPI records.
The company has described registration as the step that gives an agent dedicated OAuth credentials and lets Salesforce classify the connection. It has not publicly detailed a universal detection mechanism for unregistered agents that resemble ordinary API clients. Organizations should therefore treat classification as a governance and contract requirement, not assume the platform will automatically discover every agent.
Admins should also confirm how existing negotiated entitlements, renewals and production testing allowances apply to their specific order forms. Salesforce Foundations is currently listed at $0 and can enable Flex Credit usage, but the final bill will depend on the HPI multiplier, actual call volume and any other Salesforce services an agent invokes.
The move gives enterprises a better security primitive: an AI agent gets its own identity, limited access and an auditable trail. It also turns agent architecture into a consumption decision. Before November, the organizations in the best position will be the ones that can name every agent touching Salesforce, show exactly what each one can do and measure how many calls it takes to finish useful work.
