Stop buying the demo model
On September 10, 2026, Salesforce published its Trusted Enterprise AI Harness. The story is not that Salesforce has another model. The story is that Salesforce named the layer mid-market buyers should have been diligencing all year: the harness around the model.
Six capabilities sit in that frame. Trusted Context. Trusted Agency. Trusted Action. Trusted Governance. Trusted Security. Trusted Models. Alongside them sits a new AI Control Plane. Foundations are available now. The unified experience is planned to begin rolling out in early FY28.
If you are a mid-market operator, that announcement is useful even if you never buy Salesforce. It is a checklist. Buyers keep arguing about which model wins a demo. Operators who keep their jobs diligence the harness that keeps that model from becoming an uncontrolled cost center, a data leak, or a locked-in vendor.
This is the same discipline as auditing your AI tool stack before you add another seat. The model is the commodity. The harness is the operating system.
What a harness actually is
A harness is the reusable layer that gives agents shared context, a way to decide, a way to act, and the controls that keep those actions inside policy. Salesforce’s own framing is blunt. Models will keep changing. Proprietary context is what differentiates the enterprise.
Think about a simple customer question: can we fulfill this order today? CRM has the relationship. ERP has inventory. Contracts have entitlements. Policies say what can be promised. Memory holds prior interactions. No single system answers that question. An agent that only sees a chat window will invent a confident answer. An agent sitting inside a harness can pull governed context, reason against business rules, take a permitted action, and leave an audit trail.
That is not marketing language. That is the difference between a pilot that impresses the board and a production system that finance will fund next quarter.
| Harness piece | What it does | Buyer ask |
|---|---|---|
| Trusted Context | Shared customer and business understanding from governed data | Same definitions of customer and inventory as finance? |
| Trusted Agency | Reasoning and planning with hard stops where certainty is required | Where can AI reason, and where does a rule stop it? |
| Trusted Action | Secure calls into apps, APIs, workflows | Which systems can it write, and who approved that path? |
| Trusted Governance | Lineage, quality, guardrails, policy | Can I show an auditor what it used and why? |
| Trusted Security | Identity, permissions, privacy, runtime protection | Least privilege, or a god mode service account? |
| Trusted Models | Route by accuracy, cost, and fit, with room to swap | Can I change models without rewriting agents? |
| AI Control Plane | Register, observe, govern, and cost-control agents | One console for spend and policy, or twelve spreadsheets? |
You do not need all six on day one. You do need a written answer for each row before you expand past a pilot team.
Diligence the harness, not the demo
Vendors will still open with a demo. Your job is to redirect the meeting.
Ask first: show me the control plane for agents that are already live. Not a slide. The live registry. What is registered, who owns it, what it is allowed to do, and what it cost last week.
Ask second: show me model swap. Point the same agent at a different model or provider. Prove that prompts, tools, and policies survive the change. If the answer is we will migrate later, you are buying a model, not a harness.
Ask third: show me context provenance. When the agent answers can we fulfill today, which systems contributed, which fields were used, and which policy gated the promise. If the answer is the model figured it out, stop the meeting.
Ask fourth: show me action boundaries. List the write paths. Inventory reserve. Order update. Ticket create. Payment release. For each path, name the identity, the approval rule, and the rollback. Agents that can only draft email are not the risk. Agents that can mutate ERP are.
Ask fifth: show me cost and exception handling in the same place. Token burn without an owner is not innovation. It is an unassigned P&L line. The control plane should attribute spend to a team, a use case, and a model, and should surface blocked or redacted actions with a reason code.
These five asks map cleanly to Salesforce’s own public frame. They also map to any serious vendor that claims an open or composable stack. Use them whether the logo is Salesforce, your existing CRM vendor, or a thinner gateway you already run.
Why mid-market buyers get this wrong
Mid-market teams underbuy the harness for three reasons.
First, the budget is labeled AI model or AI seats. Procurement compares list price per seat. Nobody owns context plumbing, policy, or a control plane. The cheapest demo wins. The first production incident becomes an emergency project.
Second, IT and the business split the problem. The business wants agents that act. Security wants agents that cannot act. Without a harness, those goals fight in Slack instead of resolving in a policy table. Agency without governance is theater. Governance without action is a museum.
Third, pilots skip model swap. The pilot is tuned to one model. Six months later that model prices up, quality drifts, or a better option appears, and the rewrite costs more than the license. Trusted Models is exit optionality, not a nice-to-have.
I have watched this with RPA and early chatbots. The pattern does not change because the model got smarter. It changes when operators treat the harness as the product and the model as a replaceable part. Same discipline as evaluating AI workflows before you buy: start from control points, then score the model.
A practical 90-day sequence for a mid-market operator
You do not need Salesforce’s full unified experience on day one. Foundations are available now. Build a thin harness with what you already own, then decide on a platform upgrade.
Days 1 to 15. Inventory every AI agent, chatbot, copilot, and coding agent in production or pilot. Owner, system touched, model provider, monthly spend, write permissions. If you cannot finish the list, you need a control plane more than another model.
Days 16 to 45. Context and security floor. Pick one high-value workflow, like order promise or invoice exception. Connect only required systems. Enforce least-privilege identities. Log every tool call. Freeze new write paths until a non-engineer can read the log.
Days 46 to 75. Governance and action. Write the policy table: read, draft, execute, human required. Review exceptions weekly. Measure first-pass resolution and blocked-action rate, not vibe.
Days 76 to 90. Model routing and cost. Route cheap tasks to a cheaper model. Keep the expensive model for hard cases. Attribute spend by workflow. Show the CFO the same way you show any operating scorecard. If a vendor cannot meet that bar, do not expand seats.
Boring is how you avoid a six-figure cleanup after a flashy pilot.
How to read the Salesforce timing
Salesforce says many foundation technologies are available today, with the unified experience planned for early FY28. That timing matters.
If you are already deep in Data 360, MuleSoft, Informatica, Agentforce, or related pieces, treat this as an upgrade path, not a greenfield RFP. Ask for packaging and upgrade rules on what you already pay for. Do not sign a net-new AI commitment on a roadmap slide.
If you are not a Salesforce shop, still steal the architecture. The six capabilities plus a control plane are a vendor-neutral diligence template. Use them in every AI RFP this fall.
If a salesperson says the model is the moat, ask them to put model-swap cost in the contract. Watch how fast the conversation returns to context, governance, and the control plane.
Common failure modes
Buying seats before a registry. If you cannot name every live agent, you cannot govern one.
Letting the model hold the only copy of business definitions. Customer, available, and entitled must live in governed data, not in a prompt.
Giving agents a shared service account. That is how a helpful agent becomes an untraceable write path.
Skipping Trusted Action because the first pilot only drafts. Drafts become writes the week someone asks why the agent is slow.
Ignoring cost until the credit card statement. The control plane should make last week’s spend boring and attributable.
Confusing openness with no standards. Composable does not mean every team picks a different stack. It means you can swap components inside one policy and one observability layer.
FAQ
Do I need Salesforce to have an enterprise AI harness? No. Salesforce named a useful architecture. You can assemble a thinner version with a gateway, governed data access, identity controls, and a registry you already run. The test is whether context, action, governance, security, model routing, and fleet control exist as reusable capabilities, not whether the logo matches the press release.
Should we pause model pilots until FY28? No. Keep piloting. Pause uncontrolled expansion. Foundations are available now. Use the next two quarters to prove context provenance, action boundaries, and cost attribution on one workflow. Expand only when those three are boring.
What is the single best diligence question? Show me the live control plane for agents already in production, including spend by owner and blocked actions by reason. If that view does not exist, you are still buying demos.
Bottom line
The model wars will continue. Your board does not need you to win them. Your board needs agents that understand the business, act inside policy, and show their cost. Salesforce’s September 10 harness announcement is a public map of that requirement. Diligence the harness. Treat the model as a swappable part. Build or buy the control plane before you scale seats.
Pressure-testing an AI stack against this checklist is ordinary fractional operator work, the same work behind a practical AI stack review. Start with the registry. End with a model you can replace.
