Every team building on Salesforce has a backlog of change requests to get through, representing a lot of locked-up business value. AI reduces the time it takes to work through these tickets. But as teams go beyond just prompting in a single context to implementing semi-automated workflows with Claude Code (or Cursor, Codex etc.), we’ve noticed many of them are overlooking governance and security.
In this post, we’ll cover the main risks to be aware of and how to mitigate them without losing the benefits of AI productivity.
How Salesforce teams use AI to build on the platform
Salesforce teams are all on a journey, leaning more and more on AI to generate their changes. They start with individual experimentation, supplying context ad hoc and getting LLMs to provide a passable first version. Then Claude Code takes on the heavy lifting, working from the context of the whole repository, with team-shared skills. Some teams go further with agentic workflows, giving AI more autonomy and achieving even higher productivity.
It’s an exciting journey. But it comes to a sorry end if the security and governance guardrails aren’t built in from the beginning.
Governance gaps every Salesforce team needs to close
1. Failing to limit Claude’s access
Claude Code runs with the permissions of the user who launched it. Its permission prompts and optional sandbox reduce risk, but they’re guardrails rather than a security boundary and they’re easy to switch off. So assume Claude can reach anything you can: other repos, Salesforce CLI auth files, SSH keys, environment variables.
Depending on the compliance requirements your team needs to follow, you’ll also need to consider which records Claude should be able to retrieve by running SOQL via the MCP. HIPAA-compliant teams, for example, should ensure PHI isn’t being mishandled.
Once sensitive data has been pulled into the context window, it could surface anywhere in the output. The reliable control is limiting what’s reachable in the first place: run Claude Code in a container, mount only the repositories it should work on, and authenticate only the orgs it really needs.
2. Prompt injection
No model reliably tells the difference between your instructions and text it finds in a ticket, a code comment or a record pulled from your org. That leaves open the possibility for malicious prompt injection — instructions hidden inside the information Claude picks up.
It’s hard to filter out every malicious instruction, so limit what a successful injection could do. For example, restrict outbound network access to stop data leaving the container.
3. Bypassed testing and review
AI adoption is moving quickly and it isn’t easy to get visibility even within a team. In our experience, team leads don’t always know who has the Salesforce MCP hooked up to which orgs.
Some teams are using the MCP to jam changes into a sandbox and haven’t yet worked out how they’ll deploy successfully to production. We’ve even seen someone use the MCP to deploy straight to production, skipping peer review and testing for quality and security issues. Developers shouldn’t have production authorized for the CLI. You should use a least-privilege integration user, and restrict which MCP toolsets are enabled.
Governing every Salesforce change is vital for security. Connecting Claude Code straight to a production org means any mistake — a bad instruction, a misread requirement, a bug in the generated code — has a direct line to live business data.
LLMs readily produce Apex classes declared without sharing, SOQL with no CRUD/FLS enforcement (missing WITH USER_MODE or stripInaccessible), dynamic SOQL open to injection, and Lightning components that expose more than intended.
Bypassing governance is also a compliance issue. If you operate under SOX or similar compliance requirements, that’s an audit failure waiting to be found. Never use an MCP server as a side door that skips the pipeline. Every change should go through testing and review — and AI-generated changes are no exception.
4. Eroding org standards
Shared standards are about ensuring code consistency, which is essential for keeping your org maintainable long-term. Different patterns and naming conventions across the team make it harder to unpick production errors, pay down tech debt and refactor solutions.
Since LLM outputs are probabilistic, there’s always some risk that AI-generated changes stray outside the agreed standards. But more significantly, many Salesforce teams don’t have team-wide standards for using Claude. Instead, each developer and admin writes their own adventure, wiring up the MCP servers they care about and creating their own skills. Ten people end up with ten setups, each with a private definition of “good,” and none of those setups is visible across the team.
Don’t let five people build five different approaches to prompting, tooling, and process. Keep skills and standards files in one shared place, and make sure the whole team uses the agreed procedures.
5. No plan for future maintenance
Setting up a workflow with Claude Code is good fun. It’s important to remember, though: the end goal isn’t static. As your org, your team, your business, and Salesforce itself change, so must your process, tools and skills. Without those updates, code quality drops and security vulnerabilities creep in.
Maintaining and optimizing these workflows — especially for a larger team — quickly becomes a full-time role. That’s the cost of ownership, and without dedicating that resource it’s only a matter of time before your governance gaps widen enough to let issues through.
Discover the key insights for DevOps performance
The State of Salesforce DevOps
6. Throughput overwhelming your DevOps process
AI is multiplying the output every Salesforce team is capable of, and that increasing throughput will highlight the brittle parts of your process. Manual reviews won’t keep pace. Blockages in the pipeline will grind everything to a halt. Or worse, you fail to stop metadata changes reaching production before it’s too late, such as a loosening of permissions.
DevOps is more important than ever. A highly automated CI/CD pipeline, including automated code reviews and testing, is the prerequisite for safe delivery on Salesforce. Moving at the speed of AI makes DevOps non-negotiable.
How to set up Claude Code securely for Salesforce
To summarize at a high level, these are the steps you need to follow to set up Claude Code and mitigate the most glaring governance challenges:
- Set up Claude in a contained environment, e.g. using Docker.
- Supply your org’s metadata context — often via your Git repository (although that never captures the total shape of your Salesforce org).
- Write skills and tooling to make it reliable, validating that outputs are accurate enough.
- Standardize the process and enable the wider team.
- Ensure scalable security and quality checks — with an automated DevOps pipeline being absolutely necessary to prevent review becoming the bottleneck.
- Maintain the system through every Salesforce release and model change. And this last step is an ongoing responsibility for the team, not a once-and-done job.
…or get started today with Gearset’s AI agent Cam
Generating Salesforce changes with AI is easy. Stitching together a semi-automated workflow to scale the process isn’t too hard either. But getting quality changes from AI isn’t easy. And governing the whole process so it’s auditable and not putting your business at risk is hard.
With Gearset, you get both agentic productivity and DevOps control out of the box.
Assign work to Cam, Gearset’s AI agent, and get back changes that deserve your review. Cam arrives with built-in Salesforce expertise, based on practitioner knowledge not documentation. It knows the context of your repo and Salesforce org. It reads tickets, but asks for clarification rather than building on assumptions. It follows your org standards. And it validates against your org during the build process, fixing anything that causes a validation error before sharing for review.
You can also pair with Cam to explore your org before building anything, understanding how things work today, who built what when, and every dependency. You can even pull in production issues, have Cam explain the root cause and then build the fix.
Everything flows through your DevOps pipeline in Gearset, so every change is controlled and logged the same way. Automated code reviews, unit testing, UI testing, and CI/CD catch quality and security issues early — without manual effort. Rollback, monitoring and backup make sure you can recover quickly from any incident, big or small.
Start a free 30-day trial of Gearset today and get in touch to arrange a tailored demo of Cam and the rest of our platform. Fast track your AI implementation and scale delivery safely.
