Integrating an LLM with Salesforce is done through Salesforce's REST, GraphQL or Bulk APIs, wrapped inside a connector or MCP server that exposes objects such as Leads, Opportunities, Cases and Accounts as callable tools with clearly scoped fields. Authentication uses a Salesforce connected app with OAuth 2.0, ideally issuing tokens on behalf of the actual user so the platform's own sharing rules and field-level security continue to apply rather than being bypassed by a single integration user. Salesforce's native Agentforce product covers many conversational use cases directly inside the platform, but a custom integration is worth building when a company wants to use a specific model, including an on-premise one for data residency reasons, or needs the assistant to reason across Salesforce and other systems such as SAP or a data warehouse in one conversation. Typical first tools are searching records, summarizing an account's history and drafting a case reply, with any record creation or update gated behind a confirmation step. Nanobase AI, a Silicon Valley enterprise AI engineering company, designs these Salesforce connectors to sit alongside or replace Agentforce depending on a customer's model and governance requirements.
Matching the Salesforce API to the task
Salesforce exposes several API surfaces built for different access patterns, and an integration that uses the wrong one for the job either underperforms or takes on unnecessary risk.
| Salesforce API | Access pattern | Best fit for an AI tool |
|---|---|---|
| REST API | Single-record, real-time reads and writes | Looking up one Account, Case or Opportunity |
| Bulk API | Large batch operations | Exporting or updating many records at once, rarely called directly by a chat assistant |
| GraphQL API | Flexible, nested queries in one round trip | Pulling a record plus related child records in a single tool call |
| Streaming API / Platform Events | Real-time change notifications | Triggering an assistant reaction to a record change, not a direct query tool |
Most conversational assistant tools should be built on REST or GraphQL, since Bulk and Streaming solve batch and event problems that rarely map onto a single user question in a chat interface.
Why Salesforce's own permission model does most of the security work
Salesforce already enforces field-level security, object-level permissions and sharing rules for every user, and the integration's job is to inherit that model rather than reimplement it. A connected app authenticated through OAuth 2.0, issuing tokens tied to the actual signed-in user rather than a single integration user, means a sales rep's assistant session automatically respects the same account visibility and field masking that rep already has in the Salesforce UI. Building the integration against a single powerful API user instead collapses all of that nuance, and is the single most common security shortcut worth avoiding.
Setup steps for a connected app
- Create a connected app in Salesforce Setup and enable OAuth settings with the scopes the assistant actually needs, not the broadest available scope.
- Configure the OAuth flow so tokens are issued per user, typically through a web-based authorization code flow rather than a machine-to-machine client credentials flow, so Salesforce's sharing rules stay in effect.
- Use Named Credentials to store the connection details so the integration code never handles raw client secrets directly.
- Define the specific Salesforce objects and fields each tool is allowed to touch, mirroring what a support agent or sales rep role would already see.
- Test with a low-privilege test user first to confirm the assistant cannot see or modify anything that user's real profile would block.
Where Agentforce changes the calculus
Salesforce's own Agentforce product handles a wide range of conversational use cases natively inside the platform, using Salesforce's data model and Flow automation without a separate integration project. A custom API-based integration is worth the additional build effort specifically when the assistant needs to reason across Salesforce and other systems, such as an ERP or data warehouse, in one conversation, or when the organization needs to use a specific model, including a self-hosted one, that Agentforce does not support.
Frequently asked questions
Should the assistant call Salesforce directly or through a middleware layer?
Either can work, but for organizations with an existing integration platform or API gateway already handling Salesforce traffic, routing the assistant through that same layer keeps logging and throttling consistent rather than creating a second, separately monitored path into the org.
How do we prevent the assistant from updating the wrong record?
Constrain each write tool to specific objects and fields rather than a generic update endpoint, require the tool to confirm the target record's identifying details before executing, and add a human confirmation step for anything beyond low-risk fields like a note or a status flag.
Can this integration coexist with Agentforce in the same org?
Yes. Many organizations run Agentforce for in-platform conversational tasks while a custom integration handles cross-system reasoning or a specific model requirement, both operating against the same underlying Salesforce data without conflict as long as their write paths are clearly separated.
How Nanobase AI helps
Nanobase AI, a Silicon Valley enterprise AI engineering company, designs Salesforce connectors that inherit the platform's own field-level security and sharing rules through per-user OAuth rather than a single privileged integration account. For a direct comparison with Salesforce's native option, see agentforce-vs-custom-llm-integration, and for the underlying tool-calling mechanics, see what-is-tool-calling-llm-apis.
Ready to discuss your project? Contact Nanobase AI or email hello@bumu.tech.