01 / Principal and identity
Who acts, and what can the platform identify?
A service agent acts for a named support case and customer.
Salesforce permissions identify the connected user or integration principal.
- 01Originating task
- 02Agent or workload
- 03It updates an opportunity stage or customer account field.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Check the specific object, record, field and proposed value in a governed API path.
Separate ordinary case notes from high-impact ownership, bank-detail or stage changes.
Delegation constraint
A delegated support task must not borrow a sales administrator’s broad credential.
03 / Worked denial
Test a request outside the grant.
The agent can append a case note but proposes changing a payout account on the customer record.
Adversarial verification
Change a permitted case-note field, then attempt an unapproved payout-account field mutation on the same record. Compare field-level decisions and the final Salesforce record version.
04 / Review and responsibility
What should the audit trail prove?
Actor, case, object/record/field, old/new values, approval, decision and record version.
Native Salesforce access controls remain necessary; this architecture adds task-specific decisions.
Platform primary source