Salesforce’s Summer ’26 Release continues the platform’s fast agentic evolution. Agentforce is being embedded directly into the flow of work, opening new ways for teams to design and execute processes.
At the same time, there is a pronounced shift towards enforced baseline security standards. Several key changes don’t just encourage best practice, they enforce it. For most organisations this is a positive step, but it introduces short-term risks for those unprepared.
In this post, I’ll break down the five key signals from Summer ’26, what they mean in practice, and where to focus.
Secure by Default: Salesforce Tightens Defaults
One of the most striking themes in Summer ’26 is the shift towards enforced security.
Salesforce is moving beyond recommending best practice and beginning to require it. Controls that were previously optional, but strongly encouraged, are becoming baseline platform expectations.
For most organisations, this is a positive step. Nonetheless, it also introduces short-term risks, particularly for legacy or less-governed implementations that rely on system context or overly permissive access grants.
Notable examples include:
- Apex defaults to user mode (API version 67.0+). System level access is no longer assumed, meaning object, field and sharing rules are enforced by default. Review Apex when upgrading API versions and explicitly define access modes required.
- NOTE: Apex Triggers are an exception as these will now always run in system mode across all API versions. Ensure trigger handlers define sharing and access.
- Legacy username/password authentication (SOAP login and OAuth username-password flows) is being phased out. Identify and migrate affected integrations now.
- Stricter authentication requirements (MFA for all users, phishing-resistant MFA for admins) will be enforced across production and sandbox environments. Review authentication and IP considerations to avoid disruption to your org.
Alongside this, Salesforce is tightening security controls more broadly. Weekly Health Check notifications are enabled by default for new production orgs, profile visibility is more restricted, an additional permission is needed to manage Transaction Security Policies and step-up verification is applied to protect sensitive actions, such as report data downloads.
Together, these changes all reinforce that Salesforce is taking decisive steps to harden the ecosystem’s default security standards.
Agentforce: AI in the Flow of Work
Salesforce’s ‘Agentic Enterprise’ vision continues to take shape in Summer ’26, with Agentforce embedded more deeply into the flow of work for both end users and admins.
This release reinforces a clear direction, with Agentforce increasingly integrated into how processes are designed, built, tested, and executed. Key updates include:
Automation
Using Agentforce in Flow Builder is becoming easier (e.g. create agents via a new element, update screen flows via natural language, and improved troubleshooting via ‘Ask Agentforce’). This accelerates automation development and improves quality.
Marketing
Enhancing marketing optimisation and sales alignment (e.g. account nurturing, real-time journey decisioning, and paid media campaign monitoring). These capabilities are centred on Marketing Cloud Next, supporting personalised engagement and stronger alignment between marketing and sales.
Sales
Enhancing sales workflows (e.g. automated group scheduling during lead generation and nurturing, and greater control over agent-driven field updates). This reduces manual effort and supports better conversion rates.
Service
Improving service operations (e.g. identifying the best available experts based on case context and availability, completing routine communications with agentic SLA milestones, generating case comments grounded in case context and interactions, and email responses grounded in selected knowledge articles (up to three)). This improves resolution speed, reduces manual effort, and supports consistent service delivery.
Agentforce Contact Center
Agentforce Contact Center is gaining momentum in Summer ’26, representing Salesforce’s move towards an AI-first, fully integrated contact centre across voice, email and messaging.
This release reinforces that direction through deeper automation and orchestration, including seamless AI-to-human escalations with full context, proactive outbound engagement (e.g. reminders and surveys, handled via IVR, Agentforce Service Agents, or escalated to a human agent), and more intelligent routing based on SLAs and prior interactions. It also introduces greater control over how Agentforce Service Agents handle email through Agent Script, enabling more deterministic and governed behaviour.
Taken together, these updates highlight a continued shift towards autonomous, context-aware contact centre operations, where AI and human agents work together in a coordinated way.
Flow as the Execution Layer: The Plumbing of the Agentic Enterprise
One of the strengths of Agentforce is its ability to reuse existing business processes and logic within Salesforce. Rather than replacing deterministic automation, Agentforce builds on top of it. It can invoke established processes where appropriate, whilst also enabling Flow to leverage AI-driven decisioning and outputs when needed.
In practice, this positions Flow as the execution layer of the Agentic Enterprise: the primary declarative mechanism through which Agentforce delivers business processes with precision and control, complemented by programmatic logic in Apex where required.
As such, updates to Flow are becoming increasingly important, both in their own right and as part of the wider Agentic Enterprise vision. Summer ’26 introduces several enhancements that make Flow easier to build, operate, orchestrate, and scale. For example:
- Improving Flow scalability for scheduled processing with configurable batch sizes (1-200), helping to manage governor limits. This makes Flow more viable for complex, enterprise-scale processing.
- Enhancing observability of Flow element error rates via Flow List Views. This makes it easier to monitor, triage, and maintain Flows used across your solutions.
- Simplifying decision logic with additional date operators (e.g. ‘Is Today’ and ‘Is Anniversary of Today’, etc). This reduces the need for complex formulas and improves maintainability.
- Strengthening governance with enhanced Flow comparison capabilities (greater granularity), including support for Transform elements. This reduces deployment risk and supports change management.
Alongside this, updates such as the ability to require unanimous Flow approvals and increased parity for Marketing Flow Types (e.g. support for Wait and Decision elements across all Flow types) further strengthen Flow’s overall capability.
These changes reinforce Flow’s role as the platform’s execution layer, supporting both traditional automation and agentic use cases at scale.
From Chatter to Slack: The farewell tour of the Social Enterprise?
At the start of my Salesforce career (in 2010!), I recall how Salesforce heralded the rise of the ‘Social Enterprise’, with Chatter front and centre. However, times change. Since Slack’s acquisition in 2021, the future of Chatter has increasingly come into question. Slack offers broader collaboration capabilities and, with its deepening integration into Salesforce and interoperability across other platforms, is now positioned as the conversational ‘work operating system’.
Summer ’26 provides two clear indicators that Chatter’s role is diminishing:
- Chatter is turned off by default in new orgs (but can still be enabled, for now). This means features such as Chatter Feeds, Groups, and the Follow button are hidden.
- A Slack workspace is automatically created for eligible new orgs, with the new Slack Panel enabling easier use of Salesforce Channels.
That said, this release does not retire Chatter. Except for Chatter Answers, there is no confirmed retirement timeline, and some feature gaps remain (e.g. Case feeds for external collaboration via Experience Cloud). Chatter is therefore unlikely to disappear overnight, but could be on its farewell tour.
Nonetheless, the direction of travel is clear and aligns with the broader shift towards the ‘Agentic Enterprise’. For organisations relying on Chatter for internal collaboration, it is worth beginning to explore alternatives in Slack as it becomes Salesforce’s primary collaboration layer.
Salesforce as an AI Platform: APIs, MCP and External Agents
Why should you ever log into Salesforce again?
This thought-provoking comment highlights Salesforce’s evolving direction. The platform has long been API-first, but Summer ’26 continues its shift towards becoming a true AI-first platform; one capable of orchestrating work across systems, business processes, and enabling interactions between humans and agents.
A key part of this evolution is interoperability. Summer ’26 introduces several features that reinforce this direction, including:
- Supporting secure external AI agent integration via hosted Model Context Protocol (MCP), enabling systems such as Claude, ChatGPT and Cursor to securely access Salesforce (and Data 360) data and automation without custom integration.
- Expanding MCP capabilities for metadata and platform interaction, making it easier for agents to understand and act on Salesforce’s structure.
- Scaling access to custom SOQL queries via the Named Query API for REST API Clients and AI Agents (enabling more efficient and reusable data access).
- Strengthening API governance through MuleSoft’s API catalog, helping to control API and MCP usage and minimise sprawl.
- Evolving Salesforce’s AppExchange to the AgentExchange, to make it easier to identify and deploy agentic capabilities to business workflows.
Together, these changes point towards a ‘headless model’, where Salesforce’s capabilities can be invoked without direct interaction with Salesforce’s UI. In other words, Salesforce becomes the control plane where business logic, data and actions are orchestrated.
This also helps explain the focus on security. As Salesforce increasingly opens up to external agents and systems, stronger controls are essential to ensure AI-driven interactions remain secure and governed.
Quick Hits: Worth a Look
Alongside the key themes in Summer ’26, several additional enhancements are worth noting:
- Flow Orchestrator is now a standard Flow feature, removing usage-based limits and making multi-step, multi-user automation more accessible.
- The ‘Send Email’ action now references templates by name rather than ID, simplifying release management and reducing post-deployment steps.
- Flow Data Tables support related record names (instead of displaying IDs) and navigation, improving user experience and bringing closer parity with other components (e.g. Related Lists).
- Web Console (Beta) introduces a new browser-based development environment for building, running and debugging code.
- Salesforce Release Manager (Beta) enables controlled preview of upcoming features via Dev Channels, supporting safer rollout planning.
- Field Access Summary provides a consolidated view of field-level security (FLS) across profiles, permission sets and permission set groups via Object Manager.
- ‘Grant Access using Hierarchies’ for Queues provides control over whether record access is inherited up the role hierarchy.
- ‘Manage Shared List Views’ allows users to share personal list views (with roles, groups and territories they belong to) without requiring the broader ‘Manage Public List Views’ permission.
- Dark Mode’s rollout continues within Salesforce Lightning Design System 2 (SLDS 2), with it now being available in Performance and Unlimited editions. You can also upload a dark-mode friendly version of your company logo.
- Reporting and Dashboard enhancements, such as support for multiple text-values in Dashboard filters (comma separated), support for 2 row-level formulas in reports and apply brand theme palettes to charts.
These updates enhance user experience, developer productivity, release management, and access governance across the platform.
Watch Out (What could break)
Alongside new capabilities, Summer ’26 introduces important Release Updates that may impact your implementation, particularly around accessibility, security and platform behaviour.
Upcoming Release Updates
| Release | Number of Updates | Key Areas Impacted |
|---|---|---|
| Summer ‘26 | 6 | Accessibility improvements; authentication updates (SAML framework, Salesforce-managed X app); Apex behaviour changes (batch result ordering, PDF rendering consistency). |
| Winter ‘27 | 6 | Accessibility improvements; email domain authorisation, profile filtering, transaction security permissions, OAuth 2.0 username-password flow retirement (Connected Apps), API routing changes (instance URL traffic support ending). |
| Spring ‘27 | 5 | Accessibility; major retirements (Salesforce-to-Salesforce, SOAP API login for versions 31-64); platform behaviour changes (asynchronous sharing recalculation impacting Apex and Flow). |
| Summer ‘27 | 1 | Apex security hardening (blocking managed package anonymous code execution). |
| No Scheduled Enforcement Date | 2 | Locale format changes (ICU) and Apex-related updates. |
These updates further reaffirm Salesforce’s direction of tighter security and standardising platform behaviour.
Feature Retirements
In addition to release updates, several notable retirements require planning:
- Salesforce-to-Salesforce retires in Spring ’27. Evaluate alternatives (e.g. Data 360 or integration).
- Unified Knowledge retires in Summer ’27. Review Salesforce Enterprise Knowledge (requires Data 360).
- Salesforce Platform APIs (versions 31-40) are being deprecated in Summer ’27 and retired in Summer ’28.
- Standard Omni-Channel retires in Summer ’26. Orgs are automatically upgraded to Enhanced Omni-Channel, but standard channels must be reviewed and updated.
- Standard Facebook Messenger and SMS Channels will be retired on the 1st of June and 1st of July 2026 respectively. Upgrade to Enhanced channels immediately.
- Open CTI is scheduled for retirement on the 28th of February 2028. Recommended alternatives include Salesforce Voice or Agentforce Contact Centre.
Check the Release Updates and Feature Retirements for information impacting your org.
Additional Items Requiring Attention
Some items may not be formal retirements but risk disruption if not prepared for:
- WhatsApp user identity changes (usernames and Business-Scoped User IDs (BSUID)). Users may display usernames instead of phone numbers. Automations relying on phone numbers for routing or matching require review ahead of Meta’s phased rollout, starting in June.
- Einstein Activity Capture (EAC) changes, including migration to Microsoft Graph by August 2026 and ahead of Exchange Web Services retirement. Auto-migration of captured emails to standard objects (Tasks and EmailMessage) requires planning to avoid reporting and storage implications.
What requires attention now?
Whilst every org differs, priority areas for many orgs will likely include upcoming security and authentication changes and SAML-framework updates. If you use Einstein Activity Capture, WhatsApp Integrations or standard SMS/Facebook Messenger channels, urgent attention is advised to avoid disruption.
Planning further ahead, OAuth 2.0 Username-Password Flow retirement, API traffic routing and email domain verification in Winter ’27 also need to be considered. If you rely on Open CTI, begin planning early to allow time for migration ahead of its retirement in February 2028.
Summary: The Penguin Take
Summer ’26 is another clear step towards Salesforce’s Agentic Enterprise vision. Agentforce is becoming more deeply embedded across the platform, while Flow continues to strengthen its role as the execution layer, underpinning both deterministic and agentic processes. Simultaneously, baseline security is being significantly hardened, reinforcing the need for stronger governance and secure-by-default implementations.
As a platform, Salesforce is becoming more open and interoperable. While Slack is the clear default, the platform is increasingly enabling external technologies (e.g. Claude, Cursor, ChatGPT) to securely interact with its data and automation. This allows organisations to adopt their preferred, and increasingly conversational, interfaces, while using Salesforce to orchestrate processes, systems, users and agents at scale.
This does not mean the UI is irrelevant. For high-volume, repeatable interactions, a headless approach offers clear advantages, and Salesforce is paving the way for this. However, for more complex or context-heavy use cases, the UI remains critical and is likely to remain so for the foreseeable future.
Either way, the landscape is shifting quickly. Organisations that are embedding agentic capabilities into their processes now and investing in strong data quality, governance, and security will be best positioned to take advantage of the innovation in the years to come. In the Agentic Enterprise, Salesforce is no longer positioning itself as solely a CRM. It is evolving into a control plane for getting work done.
Until next time, thanks for reading! 🐧
Bonus Penguin Fact 🐧
Did you know the oldest known Humboldt penguin in the world today is 38 years old? Spneb, a Humboldt penguin at Paradise Park Wildlife Sanctuary in Cornwall, England, recently celebrated her milestone with an ice cake topped with fish.
In the wild, Humboldt penguins typically live 15-20 years. With human care, they normally reach 20-30 years, making Spneb’s age truly exceptional.
Subscribe to Blog via Email
Want More?
Found this article useful? Why not share!
Or check out some of our other articles: