Salesforce, the world's largest vendor of customer relationship management software, has previewed Trusted Enterprise AI Harness ahead of Dreamforce, its annual conference running September 15–17 in San Francisco. It is six "trusted" layers — Context, Agency, Action, Governance, Security, Models — plus a new AI control plane for finding, policing and paying for agents across an organization. The argument behind it is that as foundation models get better and cheaper, a company's durable advantage moves out of the model and into the private context and operating rules built around it. General availability begins early in Salesforce's fiscal 2027, which starts in February 2027, and no prices have been published.
The word harness normally describes something narrower: the software environment around a model — tools, context, instructions, runtime. Salesforce is borrowing a term that has settled around coding agents and stretching it. Anthropic's Claude Code, which Anthropic calls an agentic coding tool; DeepSeek Harness, a locally oriented development and execution environment for coding agents; and OpenAI's Symphony, a deliberately minimal orchestration layer for the same — all of them sit close to execution and orchestration. Salesforce wants its Harness to also cover enterprise context, security, governance, model choice and centralized controls: everything that decides what an agent can know and what it is allowed to do.
Rohan Kumar, Salesforce's president and chief platform and engineering officer, told VentureBeat before the announcement that the intelligence models provide is becoming ubiquitous, and what stays unique to an organization is its "trusted enterprise context" — customers, employees, transactions, the relationships between data, knowledge and history. An increasingly autonomous agent needs more than access to a strong language model, Kumar's argument runs. It needs to know what the company means by revenue, churn or account health; what data it may touch; what actions it may take; and how those actions get tracked, governed and billed. Without that, he said, even the strongest model cannot reliably reason or act on the company's behalf.
Salesforce's own researchers have put a number on a much narrower version of this claim. In a preprint published September 8, the team defines the harness as the system prompt, tool set, execution hooks and supporting context-management infrastructure around a language model. Across seven enterprise agent benchmarks, rebuilding that harness around a small Qwen model lifted average task success from 29.2% to 78.0% — a gain of 48.8 percentage points with the model's weights untouched.
The second half of that paper is the more interesting part, and it cuts against the marketing. After optimizing the harness, the researchers fine-tuned the weaker model to imitate action trajectories produced by a stronger expert model. Average success fell from 78.0% to 63.1%, and it fell on all seven tasks. The researchers attributed the regression to a loss of alignment between model and harness: the weaker model adopted the expert's planning strategy without the capability to execute that plan inside a harness tuned to its own prior behavior. A narrower intervention worked better — the expert corrected individual bad steps while preserving the weak model's own planning trajectory, and average success rose to 79.7%.
That result sits awkwardly next to Trusted Models, the sixth capability, which is supposed to let companies plug in different models and route tasks by accuracy, performance, cost and business requirements. The preprint is a preprint, not a production evaluation of the shipping product, and it studies a far narrower definition of harness than the one Salesforce is selling. But it says something Salesforce's pitch does not: model and harness are not independent components you can swap one at a time. A harness tuned for one model's planning and execution may have to change when the model does. The promise of free model substitution is the part of this announcement I would ask the hardest questions about, because Salesforce's own lab has already shown the failure mode.
The six layers themselves are a reasonable decomposition. Trusted Context fuses customer records with data, metadata, semantics, knowledge, real-time signals and memory. Trusted Agency covers reasoning, planning, state, memory, interaction and orchestration, and allows deterministic constraints where a business process demands predictability. Trusted Action connects agents to applications, APIs, workflows and tools. Trusted Governance adds data lineage, quality, policies and guardrails. Trusted Security covers identity, permissions, privacy, data protection and runtime safety. Trusted Models handles routing. Customers can take all six as one system or pick pieces and mix them with existing and third-party technology.
The distinction Salesforce keeps returning to is between open-ended reasoning and deterministic execution. A model can decide probabilistically what to do next; a business cannot always absorb the same uncertainty when the agent is reserving inventory, changing an order, approving access or handling confidential customer data. Salesforce frames the whole problem with one question: can this order be fulfilled today? Answering it may require CRM data on the customer, stock levels from ERP, contract terms, metric definitions from analytics, company policy, prior interaction history and the workflows to actually fulfil it. Harness is meant to turn those scattered sources into reusable context and rules that several agents and several models can share.
The control plane is aimed at a market condition Salesforce can point to. VentureBeat Intelligence's July Agentic Orchestration Pulse Survey found 85% of organizations running at least two agent orchestration platforms at once, with an average of 3.1 per organization; 107 qualified respondents from companies of 100 or more employees took part. By the end of 2026, 53% expect their primary agent control plane to be hybrid — vendor-native tooling plus external orchestration. The sample skewed toward large technology organizations, so the figures indicate direction rather than market share. They also describe exactly the environment Salesforce is betting on: heterogeneous agent stacks, with a governance layer above them that will stay heterogeneous too.
Which is why a control plane that only sees one vendor's agents covers a fraction of what respondents described — and why Salesforce is not alone here. Microsoft Agent 365 has been available to commercial customers since May, positioned as an enterprise control plane for observing, governing and securing agents, including ones running outside Microsoft's ecosystem. AWS made Amazon Bedrock AgentCore Harness generally available in June, with a definition closer to a conventional runtime harness — orchestration loop, tools, context window, persistent state, failure recovery — extended with identity, memory, gateways, observability, evaluations and policies. AWS explicitly supports swapping models without rebuilding agent logic. Salesforce's differentiator is scope: it is trying to fold control-plane duties and runtime duties into a single architecture that also reaches into the customer data, semantics, workflows and rules already sitting inside Salesforce applications.
None of this is being built from zero. The foundations are Data 360, Informatica, MuleSoft and Agent Fabric, Tableau, Agentforce, Salesforce Guardian and Salesforce Platform — which explains why Salesforce means more by "context" than retrieving records for a model. Informatica finds, classifies and governs data. Tableau's semantic models encode the language a company uses for its metrics and operations. Data 360 unifies customer and enterprise data, including data held outside Salesforce. MuleSoft and Agent Fabric connect agents to actions and systems. Kumar said Salesforce is actively repositioning MuleSoft inside Harness toward control-plane work: language model endpoints, MCP servers, and agents operating across different parts of an organization.
The most consequential design claim is that customers will not have to buy every layer from Salesforce. The company says Harness is being built with no mandatory user interface, exposed through MCP, APIs, skills and plugins, and names Claude, Slack, Microsoft Teams and Agentforce as environments its capabilities can embed into. This is part of a broader "AIforce" strategy. Sean Malhotra, chief technology officer of Rocket Mortgage, endorsed the reasoning in Salesforce's announcement, saying his company does not want to tie its future to a single closed stack while AI technology keeps changing. The composability still has to be demonstrated. Enterprises already own models, data platforms, security systems and agent frameworks from multiple vendors; Harness is more convincing if it can govern and extend those investments than if it becomes one more stack to migrate onto wholesale.
The question the announcement is quietest about is money. There are no SKUs, no per-user or consumption rates, no minimum commitments and no final licensing model. The public wording says existing customers will be able to upgrade eligible Salesforce investments and receive additional Harness capabilities as they arrive — which is not the same as saying those capabilities are included in what they already pay for. Salesforce claims the products customers run today are the architectural foundation of Harness; it does not claim they are the entitlement. Kumar said the commercial model is still being worked out, with simplicity and predictability as principles, customers paying in line with usage, and a "single currency" across capabilities. Which editions count as eligible, what exactly has to be upgraded, whether individual Harness layers can be licensed independently, and how model, agent, data and action usage lands on the invoice are all unanswered. The architectural promise is stated far more clearly than the commercial one.
So the pitch is credible and the timing is not. Salesforce is telling enterprises that competitive advantage in AI is migrating from the model to the architecture around it — a reading I think is largely right — and then asking them to wait until February 2027 for the first capabilities, with availability varying by region and pricing to be disclosed closer to launch. Companies deploying agents now will not pause for a branded harness; they will assemble one, and the assembled version will be running in production by the time Salesforce's ships. At that point Harness has to win on price, usability or capability against a working system its buyers already built themselves.