Salesforce Patents a Permission System for AI Agents That Talk to Each Other
As companies wire up multiple AI agents to handle different business tasks, a big question emerges: what stops one agent from handing sensitive data to another that shouldn't have it? Salesforce is filing a patent for a system that enforces access rules every time agents communicate.
What Salesforce's AI agent permission system actually does
Today, when companies deploy multiple AI assistants to handle different jobs (one for HR, one for finance, one for customer support), there's no built-in traffic cop controlling what data one AI can ask another for. That gap can let sensitive information slip across departmental boundaries by accident.
Salesforce's patent describes a system where every message between AI agents goes through a policy check. If a customer-support agent asks a finance agent to look up something it's not allowed to see, the request gets blocked before any data moves. The rules are defined by tags attached to data and a corresponding list of what each tag permits.
For you as a business user, this means your company can deploy a whole team of AI agents without worrying that one will accidentally expose payroll records to a sales bot. The guardrails are automatic and baked into how the agents talk to each other.
… transmitting, from the first agent to a second agent of the plurality of agents, a message indicating an operational domain and a requested operation involving first data of the tagged data; …
Translation: One AI agent asks a second agent to perform a task using specific tagged information.
How the policy check gates each agent-to-agent request
The system revolves around a network of AI agents, each built around a set of large language model (LLM) prompt templates (pre-written instructions that shape how each agent thinks and responds). Every agent is assigned to one or more operational domains, essentially its job description within the business.
When a user sends a query, the receiving agent may need to ask a sibling agent for information. Before any data is returned, the system checks an agent access policy: a rulebook that maps data tags to permitted operations. A tag might be something like "payroll" or "customer-PII," and the policy would specify which agents can read, summarize, or transform data carrying that tag.
The verification step sits between the request and the reply:
- Agent A sends a request to Agent B, naming the domain and the operation it wants to perform.
- The system checks whether Agent A's request is permitted under the policy for that data tag.
- Agent B sends back only what the policy allows, and Agent A passes that answer to the original user.
The data stores themselves are pre-tagged, so the policy engine doesn't need to inspect content at query time. It matches the tag on the data to the rules already defined for that tag, making enforcement fast and consistent.
… verify whether the requested operation is permitted by an agent access policy that indicates a plurality of tags and one or more permitted operations associated with each respective tag.
Translation: The system checks a security rulebook to see if the second agent is allowed to handle that data tag.
What this means for businesses running multi-agent AI
Enterprise AI systems are moving quickly from single-purpose chatbots toward fleets of specialized agents that hand work off to each other. Without a clear permission layer, the weakest agent in a network becomes the weakest link for data exposure. A customer-service agent that can query a compensation database and relay the result to a user is a compliance problem, even if neither agent was "hacked."
This patent addresses that problem at the architecture level rather than leaving it to individual developers to code access checks into every agent they build. For companies in regulated industries (healthcare, finance, legal), a built-in, policy-driven gate between agents could be the difference between a compliant deployment and one that isn't.
That makes this Salesforce's 16th filing we've tracked since May in the AI guardrails race, joining their two-graph accuracy work and harmful request flagging.
The compliance officer trying to roll out AI assistants across a company faces one stubborn problem: HR data, financial records, and customer information all live under different access rules, and every time one AI helper asks another for information, that request can slip through a gap the policy never anticipated.
This system puts a checkpoint on every message between AI assistants, verifying whether the data being requested is actually cleared for that specific use. A payroll assistant asking a customer-service assistant for information it has no clearance to touch gets stopped before anything moves.
For the enterprise buyer, that checkpoint is what converts a stalled pilot into a signed approval. The concrete payoff is simple: AI assistants can finally be deployed across sensitive departments without the legal team waving a red flag every step of the way.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Salesforce patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
8 drawing sheets from US 2026/0278268 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in