Before you connect AI to Salesforce, find out who in your org can do everything
A free audit of permissions, access and AI settings for companies with up to 100 users. You find out who and what can change things in your org: people, integrations and agents. Within a week, with a report you can show the board.
What can go wrong
- An AI agent runs on an administrator account. An employee asked it to “tidy up the contacts”. The agent had the rights to delete them.
- The implementation partner finished the project two years ago. Its account with full rights is still active.
- A sales rep connected ChatGPT to Salesforce with his own login. ChatGPT now sees everything he sees.
AI and MCP do not add permissions. They use the ones already there. If those are too broad, AI does damage faster than a person.
What I check: 10 points
People and permissions
- How many administrators there are and whether each needs it (Modify All Data, View All Data, Author Apex).
- Accounts of former employees and contractors, shared logins.
- Login: MFA, IP ranges, session timeout, password policy.
- Who sees whose data: org-wide defaults, roles, sharing rules.
- Sensitive data (national ID numbers, tax IDs, bank accounts): who sees it and whether it reaches AI.
AI in Salesforce
- What is switched on (Einstein, Agentforce), who has access, who watches usage.
- Which account the agent runs on and what rights it has.
- What the agent can do: read only, or also change, delete, send email. Einstein Trust Layer settings.
MCP, API and code
- What is connected from outside: Connected Apps, OAuth tokens, MCP servers, employees’ personal AI assistants.
- Who can deploy to production, code that bypasses permission checks, guest access, credentials in code.
What you get
- A 2–3 page report.
- Risks on three levels: fix now, fix this quarter, good to know.
- Split into “you can do this yourselves in an hour” and “needs a developer”.
- A 20-minute call about the results.
How it works
- The form below.
- Qualification within one business day.
- A 30–45 minute screen-sharing call. I do not need access to your org.
- Report within three business days.
- A call about the results.
On request: a read-only configuration account, deactivated after the audit.
Why free
The audit starts a conversation about looking after the system. Some companies then ask me to fix things or take on ongoing support, some do it all themselves. Both are fine. I do at most four audits a month.
Who it is for
The owner or head of sales
Hears “let’s connect AI to the CRM” and does not know what that means for company data. Gets a report written in terms of consequences: who can delete your data, who sees customers’ national ID numbers, what happens when the agent gets a bad instruction.
The administrator or IT person
Knows the permissions are a mess left by the implementation partner and needs an argument for the boss. Gets a list of 10 checks with the names of the settings and what to fix themselves.
Who does it
I have been building on Salesforce since 2020. Today I am the sole owner of the Salesforce org at a Swedish software company: development, permissions, integrations, production releases. Before that, two years in a Vaillant Group team (loyalty programme, large Apex API, installer portal) and three years at Britenet for clients in education, insurance and finance. Salesforce certifications: Platform Developer I, Administrator, Platform App Builder, Sales Cloud Consultant.
I work with AI every day: Claude Code as a developer, Claude and OpenAI in production automations, Agentforce and Prompt Builder in Salesforce. I built my own MCP server with around 75 tools, exposed to the Claude assistant over OAuth 2.1, and a system where AI wrote nearly all of the code while I owned the specification, review and tests. At the company where I own Salesforce, I took part in rolling out AI in finance, accounting, administration and IT.
Questions about the audit
Do you need access to our data?
No. The standard format is a screen-sharing call: your administrator clicks, I say where to look. A read-only configuration account only if you ask for it.
Is it safe?
I do not process your personal data on my side. The report contains the names of settings and numbers, not customer data. On request I sign a non-disclosure agreement before the call.
We do not have AI in Salesforce yet.
That is the best time. The audit shows what to tidy up before you switch anything on. The Agentforce points will simply be shorter.
We have an implementation partner.
The audit does not get in their way. You can hand them the report as a task list. That happens often.
How long does it take?
From the form to the report: about a week. Your time: a 30–45 minute call and 20 minutes to go through the results.
Is there a catch?
No. After the report I propose further work. You can decline and keep the report.
Request a free audit for your company
I reply within one business day. Up to four audits a month, for companies with up to 100 Salesforce users.