Salesforce Patents a Background Check on the AI Helpers It Sends to Do Your Work
When one AI agent asks another to do a job, Salesforce's new patent application says the receiver should check the sender's identity and the whole trail of hand-offs behind the request.
What Salesforce's AI agent check actually does
An online order comes in, and no person touches it. One software helper checks the stock, hands off to another that takes the payment, which hands off to a third that books the shipping. If one helper in that line is fake, or just not supposed to be doing that job, who notices?
Salesforce's patent application describes a way to make every helper run two checks before it acts. First, is the sender really who it says it is? Second, does the whole trail of hand-offs that led to this request follow the rules? Each helper stamps its own note onto the request as it passes it along, so the last one in line can read the full trail.
That means a request can look fine on its own and still get refused because of where it came from. Impostor helpers get turned away at the door.
… authenticating the second agent using an authentication policy to determine an authentication result, wherein the authentication policy is based on authenticating an identity of the second agent; …
Translation: The system checks the ID of the incoming AI helper to confirm who it claims to be.
How each agent stamps and reads the hand-off trail
The filing covers a method where one AI agent (a piece of software that carries out a task on its own) receives a transaction request from a second AI agent. The first agent runs two checks, and both must pass before it goes ahead.
- Identity check: the agent confirms who is asking. The description pairs certificate and digital signature checks (electronic ID papers that are hard to fake) with a trained model that watches behavior, such as repeated login retries that look like break-in attempts.
- Chain check: the agent reads the chained metadata, a stack of notes that each agent in the line added. It can include the originating agent, the type of each hop and flags for policies already checked. The agent tests the whole chain against its transaction policy.
In the filing's examples, Agent X allows a type of request from Agent A when it arrives directly, but denies the same request when it comes through Agent B first. If the identity check fails, the chain check may never run.
The description also covers companies with their own go-between agents. A proxy agent asks a global registry (a directory) which other organization can handle a task, passes along a short summary, and sends the detailed, encrypted information to the final agent, which makes the authorization call.
Chained transaction metadata is determined based on multiple transactions including the second agent and a third agent.
Translation: The software tracks the full history of tasks passed along a chain of multiple AI workers.
What a final rejection means for Salesforce's filing
If software agents end up handling orders, payments and bookings for you, a lot rides on whether the agent on the other end is who it claims to be. The filing gives a concrete case: a chatbot asks a booking agent for a 20% discount when the standing rule is 10%. The booking agent treats that as high risk and can check with another agent, such as a sales agent, before agreeing.
The patent examiner has issued a final rejection of this application, so nothing here is approved. Salesforce can still amend the claims or appeal. For now it shows how Salesforce is thinking about security when agents talk to each other, and the filing describes no product you can use.
Salesforce's 20th filing we've tracked since May in the AI guardrails race adds to a pattern that includes bots that shut off early and grading and killing bad results.
Claim 1 asks for very little. It needs two AI agents, an identity check, a look at a chain of hand-offs that includes a third agent, and a final yes or no that depends on both results.
The fancier parts sit in the dependent claims: the certificate checks, the behavior model and the global registry all show up later. That leaves claim 1 covering any version of the idea. If granted, that breadth would reach any system where an agent asks who is calling and where the request came from before it acts.
The useful takeaway for any reader is that judging an agent by its whole trail of hand-offs catches things a single check misses. Whether Salesforce keeps such a wide claim after a final rejection is the open question.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Salesforce patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
10 drawing sheets from US 2026/0350608 A1 · click any drawing to enlarge
Show the other 2 sheets
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in