Solving Sharing Mysteries with Setup with Agentforce

Today on the Salesforce Admins Podcast, we talk to Nikita Kothari, Senior Member of the Technical Staff at Salesforce.

Join us as we chat about using Setup with Agentforce to understand and manage record access.

You should subscribe for the full episode, but here are a few takeaways from our conversation with Nikita Kothari.

Why can't I see this record? It's a simple question but, as any admin knows, finding an answer can get complicated quickly. If you've ever found yourself digging through Setup pages and running SOQL queries to troubleshoot permissions and record access issues, this episode is for you.

This week, I'm talking to Nikita Kothari, a Senior Member of the Technical Staff at Salesforce. She's here to tell us how Setup with Agentforce can help solve sharing mysteries. Using natural language questions, admins can trace access across org-wide defaults, role hierarchies, sharing rules, groups, and manual shares to figure out what's really going on.

As Nikita explains, permissions and record access issues are so complicated because they are affected by many overlapping configuration settings. Small changes can accumulate over time, especially in a reorg.

Setup with Agentforce was built to help you detangle these issues with simple natural language prompts. You can put your questions about permissions and record access to an agent, instead of having to wade through 1,300 pages of Setup to figure it out on your own.

Once you've got a handle on what the problem is, you can use Setup with Agentforce to help you implement changes and get everything sorted. And it's built with trust in mind: every write action requires your explicit approval, the agent is bounded by your permissions, and every configuration change is captured in the Setup Audit Trail.

If you're trying to figure out where to get started, Nikita recommends starting small. "It's very difficult to go back and fix something," she says, "so I would highly recommend trying any changes in a sandbox with the minimum set of users to see if it is working as expected or not."

And because Setup with Agentforce makes looking at permissions and record access so much easier, Nikita recommends taking advantage of it to conduct a monthly permissions review. Again, these issues accumulate over time, so an ounce of prevention is truly worth a pound of cure.

Make sure to listen to my full conversation with Nikita for more on Setup with Agentforce and how to get sharing straightened out in your org. And don't forget to subscribe for more episodes of the Salesforce Admins Podcast.

• Salesforce Admins on the Trailhead Store

• Salesforce Admins Blog Post: Mastering Your Org's Sharing Configuration with Setup with Agentforce

• Salesforce Admins Blog Post: 5 Use Cases To Get Started With Setup with Agentforce

• Salesforce Admins Podcast Episode: Setup with Agentforce Makes Salesforce Admin Tasks Easier

• Admin Trailblazers Community Group

• Nikita on LinkedIn

• Salesforce Admins on LinkedIn

• Salesforce Admins on X

• Mike on Bluesky social

• Mike on Threads

• Mike on X

Mike Gerholdt: Today on the Salesforce Admins Podcast, we're talking with Nikita Kothari, Senior Member of the Technical Staff here at Salesforce, about using Setup with Agentforce to understand and manage record access. Sharing can be one of those invisible parts of the platform until someone can see a record they shouldn't or can't see one they need to. Nikita explains how admins can use natural language questions to trace access across org-wide defaults, role hierarchies, sharing, rules, groups, and manual shares. We also discuss why validation, permissions, testing, and human approval remain essential when AI helps make configuration changes. So give this episode a listen, click that subscribe button, maybe share it with another Salesforce admin who's ever asked, "Why can this user see this record?" Let's get Nikita on the podcast. So Nikita, welcome to the podcast.

Nikita Kothari: Thank you, Mike. It is amazing to be here. I'm from the engineering team, so you'll get my lot of perspective on how we are building Setup with Agentforce on sharing.

Mike Gerholdt: Yeah, that's exactly what I wanted to talk about. Let's first get a little acquainted with you. What do you do at Salesforce, and what are some of the things that you've worked on?

Nikita Kothari: So it's been close to two years I'm working with Salesforce. And currently, I'm working with access control and sharing space. What pulled me in is the realization that sharing is one of those invisible infrastructure layer. When it works, nobody thinks about it, but when it breaks, it actually breaks the customer trust. And you know how customer-centric Salesforce is, its number one priority is trust. So there is lot of critical issues that we are dealing with and we are trying to make the sharing as the best place for the admins. And we love our admins and we are trying to make things better for them.

Mike Gerholdt: I love our admins too. I used to be one for a while. I'd like to still think I am, but we'll see. Well, let's get into it. So I read your article and I'll link to that in the show notes. Tell me, I mean, before Setup with Agentforce, what did an admin have to do to answer a question of, why can this user see this opportunity and this user not?

Nikita Kothari: Oh, good question. So it's the simplest way of dealing with solving the sharing's toughest problems. So just to enable the Agentforce, you don't have to do anything. It comes along with the Agentforce. So go to the setup page, search for the Agentforce agent and enable your Setup with Agentforce, and then you can start writing those questions. You don't have to know anything beforehand, that's the best part of the Agentforce setup. And sharing is the challenging domain, I won't deny that. It is very, very complex. So answering even the simplest question that you ask, like, "Who this person is having access for this thing," it requires to look into a lot of different domains like OWD, role hierarchy, sharing rules, sharing groups, manual shares, to see which layer actually give that access to that particular user. And looking that information, sometimes it's easier with the UI, but most of the time user has to run lots of SQL queries to get the correct answer. And previously, admin was spending hours of work and sometimes even the afternoons just to deal with that single questions. And with Setup with Agentforce, it just a minute of work. You just give prompt to your chatbots and it'll give you the correct answer within seconds.

Mike Gerholdt: Yeah. I mean, boy, it used to be a lot of archeological digging. I think you called it that in the article. I know I used to have to feel like I was going through a checkbox, but tell me, I mean, walk us through a real investigation where an admin discovers that a user can see a record, they probably shouldn't. How would they use Setup with Agentforce to trace where that access came from?

Nikita Kothari: Yeah, great question. So while building these actions, we particularly divide it into two different segments. First segment is the read action and the second segment is the write action. Just to keep it, things untangled, read actions will help you to investigate. When you ask a question like, "Why Nikita has access for these things?" So our agent will go into the background, it will do all kinds of research and it will come up with the best answer. "Okay, Nikita is part of this group, and these groups provide the access to this particular record." And what a write action on the hand will do, it will help you to solve that problem. Now you know Nikita is part of the particular group. You can go ahead and ask your write action, "Can you please remove Nikita from this group?" And your write action will help you to remove that particular user from that group and boom, your problem is solved within a few minutes. It's reliable, it's fast, and I'm sure admin can save a lot of time with these two things. And you don't need to know which action or which thing you need. You just write the plain natural language and our LLM will be able to guess where to navigate and how to solve that problem.

Mike Gerholdt: Yeah. No, I hear you. I think you walked us through what a good sharing investigation looks like. But for you, is there a sequence admins should follow so that they don't just jump straight to changing configuration?

Nikita Kothari: I would say I would highly recommend admin to start playing with the read action. There is no particular sequence, I would say, but mostly how the sharing is defined is like first we have the OWD, which provides the base access to the records and to the objects. And then comes the role hierarchy, then comes sharing rules, then we have public groups and queue and we have the manual shares. So at each level, sharing opens up the door for more access. So if you're going below the hierarchy, sharing will provide more and more access to the user. And if you want to close that access, it's not easier that one sharing rule will open up the access and then you create another sharing rule to close the access. It's not how it works. So in that case, you need to spend a strategic amount of time thinking how you can revoke that access. And sharing is accumulation of the small, small, small decisions over the time. Sometimes adding someone to the group, for the reorg, you have to do lot of things with the sharing, and every decision gets compound. So I highly recommend our admins to at least spend 30 minutes a month to refresh and reanalyze their sharing configuration to avoid the future problem. So this is basically the flow looks like, but I would say there is any of sequencing which admins should follow. It's pretty much open and admin can ask any question to our agent.

Mike Gerholdt: No, I think you're right. I mean, Setup with Agentforce can do a lot in terms of explaining the configuration and then help change it. I think you really touched on that last answer of just slowing down for a second, verifying what the answer is to make sure that you're staying in control. My question to you would be, how should an admin validate what the agent tells them?

Nikita Kothari: Oh, that's a good question. So for the read action, the information, we have mostly the links added to our prompts. We call it as a clickable link. So if investigation is saying that Nikita is part of this group, actually, there is a link of that group. So you can go to that group by clicking on that link, and you can actually see I'm a part of that group if you want to re-verify the stuff. So, that will give you more confidence that you know how admin is investigating the information or if admin is saying, "Nikita is part of the sharing rule and you'll have the link for the sharing rule." So you can actually go and verify whether that sharing rule contains the group or the users where it is providing that access. And with the write action, I think more critical is the right action. I mean, you don't want somebody, AI is coming to your system and randomly making changes to your system. So to do that, we have the validation layers. The first validation we generally come up with is for every write action, we explicitly ask for the approval, approval from the person who is making the changes. And we also have the permission boundaries, and if particular user doesn't have the permission to edit OWD, the agent won't be able to edit OWD for that person. And then the last part is the accountability. Every change we are logging into the setup audit trail saying that whether the AI agent did it or actual person did it. And then admin can verify it, whatever changes is made by the AI agent are trustable or not. So we will always advise admin to go and do as much as possible testing on the sandbox before making changes into the production. And another backup system is the Einstein Trust layer. We always say trust is our number one priority. So, Salesforce has built trust everywhere to make sure that we are not blindly making any changes, and as this is a very, very critical domain to our customers.

Mike Gerholdt: No, that's great. You talked a lot about sharing, and I always feel like making a change with sharing, you want to make sure that you're doing it right. In your opinion, what is the most important thing an admin should review before making a sharing change?

Nikita Kothari: So I would say, as I said before, we have some of the steps that I also wrote in my blog, that we have OWD sharing rule, rule hierarchy, and everything opens up the more access. So to close that access, it's very difficult to go back and fix something. So, I would highly recommend whenever our admins are making the changes, try it out first thing on the sandbox if it is working as expected or not. Or have some verification system or another set of eyes whenever you create some rule hierarchy or you're providing some access to the rule, rather than giving access to all of the user, first try with the minimal set of the user. Try with the one user and see if that user are getting right access to the right record. Because even if you fail to provide a single user a wrong access, that means that you're leaking your data. So having those, another, just starting with a small and then going into the bigger and bigger data, that would really help admin to build the reliable system.

Mike Gerholdt: Yeah, absolutely. I think it can do a lot and I've seen it do a lot, but what is something that Setup with Agentforce can help with today that maybe admins may not realize?

Nikita Kothari: I feel like still adoption, it's tricky because people are quite a lot thinking that Setup with Agentforce will replace their job. But I would say rather than replacing, it will provide you a lot of capabilities and it will remove a lot of overhead from your day-to-day work life, rather than going and looking into the SQLs or doing everything by yourself, just give it a try. And then you can see how much opportunity it is opening up for you to save time. And that time you can actually use for building a more structural, and because structure mattered a lot when it comes for sharing. How your roles are getting access or how your groups are getting access. And if you're just blindly following the steps and not thinking much, then you are in a trouble. So you can spend more time and thinking about, how can you better make a structure for your organization? And you can get more time to think about your business. And I feel like most of the troubleshooting cases we have covered into the Setup with Agentforce flow. Yeah.

Mike Gerholdt: Yeah. You mentioned a lot, admins should get out and use it and try it, and I'm a big proponent of that. So I'll end on this question. What for you is one kind of low risk question that an admin could ask Setup with Agentforce today to better understand their sharing configuration?

Nikita Kothari: I think my one of the favorite action among all of it is record access, to ask why this person is having access to this record. And you see how much it can do, it will give you the whole list of the OWD configuration for that particular record, or it will look for the sharing role, it will look for the group membership, it will look for the manual shares. And it will do all kind of investigation for you just when you type a one single natural language to your agent. So you can always think about someone which is having more knowledge about the setup. It's sitting with you and helping you to deal with all of the setup configuration. Because setup, again, we have like 1,300 setup pages, which is lot. And going through all and learning the capabilities of each setup action, it's difficult. So, that's why we built the Setup with Agentforce, which will give you the capability that you don't have to learn everything on the go. And you can start asking question to our bot. If it won't be able to answer, it will guide you in the right direction to help and analyze your queries or your concerns.

Mike Gerholdt: Yeah. I am so glad that we have Setup with Agentforce. I feel like I could have used it 20 years ago. I know I had a lot of questions and would have to dig through my notes on org-wide and sharing and group sharing and all kinds of that stuff. So, I appreciate it. And I appreciate the article and you taking time out of your day to talk to admins and share your knowledge about sharing and setup and how we can do things better.

Nikita Kothari: Yeah. I think admins are always on the top of our list. I would love to hear from our admins how they like this Setup with Agentforce, specifically with the sharing, how it is helping them or what they are looking forward to, because I feel like most of our critical projects and best solution came up with the admin feedback. And we really want to make admin life easier. We always have meetings internally, our engineering team, our product is always so much focused about thinking about our admins, thinking about the newer way to introduce some more features to make their lives easier so that they can focus on building a reliable solution. So, it was great talking to you.

Mike Gerholdt: Yeah, no, I'm glad you could share your knowledge with us today. Thanks so much.

Nikita Kothari: Yeah, thank you so much. And one more thing, we will be at Dreamforce. Larry Sherrill is our Product Manager. They're having a lot to share at Dreamforce. So, feel free to stop at user access booth. I'll be there too, so come and say hi and share your feedback. We would love to hear back from you. And we keep making a lot of progress on Setup with Agentforce, so stay tuned, follow our blogs, and it will be something will be really helpful in future for you guys. Thank you so much.

Mike Gerholdt: Thanks again to Nikita for helping us understand how Setup with Agentforce can make sharing investigations faster without taking judgment out of the Salesforce admin's hand. And the takeaway is just really simple, use AI to uncover the source of access, validate what it tells you, and test changes carefully before they reach production. Now, if you enjoyed this episode, and I bet you did, I hope you did, you should subscribe to the Salesforce Admins Podcast. Share this episode maybe with your team, fellow team, user group. Oh, I like that, if you'd share it with the user group, that would be awesome. And then, how about this? Start with one low risk question about your own org sharing configuration and ask that to Setup with Agentforce. Until next time, we'll see you in the cloud.