AI governance often sounds like something legal, security, or IT should handle. But once AI begins working inside Salesforce, it becomes a Revenue Operations responsibility too.

Think about what an AI agent might do during a normal workday. It could summarize an account, recommend a follow-up, draft an email, update an opportunity, route a lead, or trigger a workflow. Those capabilities can save teams a significant amount of time. They can also create problems if no one has decided where the boundaries are.

What data should the AI be allowed to use? Which actions can it take without approval? When should a person step in? Who is accountable when the output is inaccurate?

These questions need answers before AI moves into production.

The point of AI governance is not to slow the team down or bury every new idea in approvals. It is to give people enough structure to use AI confidently while protecting customer data, business processes, and the company’s reputation.

Start With One Clearly Defined Use Case

The first decision is not which AI platform to buy. It is what the team wants AI to do.

“Use AI to improve sales” is too broad. “Use Agentforce to summarize recent account activity before a sales call” is much easier to evaluate. The team can identify which data the agent needs, who will use the summary, how accurate it must be, and what should happen if information is missing.

The risk also changes depending on the task. Summarizing an account is not the same as changing a forecast category, approving a discount, or sending contract language to a customer.

Before building anything, document the job the AI will perform, the people it will support, the information it needs, and the outcome the company expects. This does not have to become a lengthy planning exercise. A clear one-page use case is often enough to expose the most important questions.

Salesforce’s Well-Architected guidance for artificial intelligence recommends defining approved AI use cases, documenting the data involved, and being specific about where people remain part of the process.

Decide Who Actually Owns It

AI projects tend to involve a long list of stakeholders.

IT cares about security. Legal considers compliance. Sales leadership wants better productivity. RevOps designs the process. A Salesforce administrator configures the solution. The data team may manage the information feeding it.

Everyone has a role, but that does not mean the use case has an owner.

Each AI implementation needs one person who remains accountable for the business outcome. That person does not need to manage every configuration detail. However, they should understand what the AI does, how its performance is measured, and what happens when the process needs to change.

Revenue Operations is often in a good position to coordinate this work because RevOps already connects people, process, data, and technology. Still, governance should not sit with RevOps alone. Security, legal, IT, and the affected business teams need to participate when the level of risk calls for it.

Before launch, everyone should know who approves changes, who manages access, who reviews performance, and who has the authority to pause the use case.

Be Specific About the Data AI Can Access

Just because information exists in Salesforce does not mean every AI use case should have access to it.

The team needs to decide which objects, fields, records, knowledge articles, and connected systems the AI can use. It also needs to identify information that should stay restricted, such as payment data, confidential pricing, employee information, health records, or personally identifiable information.

Salesforce permissions provide a foundation, but AI governance goes beyond checking profiles and permission sets. Teams also need to understand how information moves through prompts, generated responses, Salesforce Flows, integrations, and external models.

Salesforce’s Trust Layer documentation outlines protections such as secure grounding, sensitive data masking, toxicity detection, audit trails, and zero-data-retention agreements with third-party model providers. Those safeguards are important, but the platform cannot decide which customer information is appropriate for a particular business process. The organization still has to make that call.

Data quality matters here too. If opportunity stages are inconsistent or important customer details live in spreadsheets, AI will only see part of the story. The answer may sound polished while still being wrong.

Before connecting AI to a revenue workflow, it is worth taking a closer look at the CRM foundation. A practical Salesforce org audit can uncover duplicate records, unreliable fields, access issues, and outdated automation before AI begins relying on them.

For companies unifying CRM and external customer information, Data 360 governance can support classification, masking, encryption, and policy-based access across Agentforce, analytics, segmentation, and activation. The technology can enforce the rules, but the business still needs to decide what those rules are.

Draw a Clear Line Between Recommendations and Actions

There is a big difference between AI suggesting what should happen and AI doing it.

An agent might recommend a follow-up task for a sales representative. That is relatively easy for someone to review. If the agent creates the task, updates the opportunity, and sends the prospect an email on its own, the impact of a mistake becomes much greater.

The right level of autonomy depends on the use case.

An agent that identifies missing opportunity information may not need the same controls as one that changes pricing, modifies renewal terms, or sends customer-facing communications. The more difficult an action is to reverse, the more carefully it should be governed.

Decide which actions the AI can complete independently, which require approval, and which are off-limits. Then define what it should do when it encounters an exception. If the information is unclear or the request falls outside its approved scope, the safest next step is usually a clean handoff to a person.

Starting with an assistive use case gives the team a chance to observe how the AI performs before granting it more authority. The Revenue Ops Agentforce governance playbook offers additional guidance for putting those boundaries in place.

Define What Human Review Really Means

Many AI plans include the phrase “human in the loop.” That sounds responsible, but it is not a complete process.

Who is the human? What are they reviewing? At what point does the review happen? What should they do when something looks wrong?

If a sales representative must approve an AI-generated email before it goes out, build that approval into the workflow. If a manager reviews a sample of account summaries each month, define how many will be reviewed and how feedback will be recorded.

The amount of oversight should match the consequences of an error. An internal recommendation may only need occasional review. Pricing decisions, legal language, financial commitments, and external communications usually require stronger controls.

Users should also know when AI contributed to an answer. Salesforce’s Trusted AI principles emphasize accountability and transparency. In practice, that means employees need enough context to evaluate an AI-generated recommendation instead of accepting it simply because it appeared in Salesforce.

Test the Messy Scenarios, Not Just the Demo

AI demos usually take place with clean data and predictable questions. Production environments are rarely that cooperative.

Real CRM records have missing fields. Two systems may disagree. Knowledge articles become outdated. Customers ask questions no one anticipated. A user may request something the agent should not be allowed to do.

Testing needs to include those situations.

The team should evaluate more than whether the response sounds professional. Is it factually accurate? Did it use the correct source? Did it expose information the user should not see? Did it select the right action? Did it escalate when it reached the edge of its approved scope?

Business users should take part in testing as well. RevOps and Salesforce administrators can confirm that the configuration works, but sales, marketing, service, and customer success teams will spot issues that are easy to miss during a technical review.

Before launch, agree on what acceptable performance looks like. Otherwise, one stakeholder may think the agent is ready while another sees the same results as unreliable.

Decide How the Team Will Monitor It

AI governance does not end when the use case goes live.

The team needs a regular way to review accuracy, failed actions, escalations, user overrides, feedback, and possible policy violations. It also needs to connect the use case to a business result.

An agent may process hundreds of requests without improving anything that matters. Activity alone is not success.

The metrics should match the original goal. If the use case was designed to improve CRM completeness, track whether required information becomes more reliable. If it was meant to accelerate lead response, measure response time and conversion. If it was intended to reduce administrative work, determine whether users are actually saving time.

The review process should also define when the team needs to intervene. A sudden increase in overrides, repeated errors, or a change to a connected data source may be a sign that the use case needs attention.

Salesforce configurations change constantly. A new field, revised Flow, updated permission, or different knowledge source can affect how the AI behaves. AI should therefore be included in the normal Salesforce change-management process.

Have a Plan for When Something Goes Wrong

Even a well-designed AI process can make a mistake.

The goal is not to pretend errors can be eliminated completely. It is to make sure the team knows what to do when one happens.

Who can turn the agent off? Where should users report a problem? Which logs need to be reviewed? When should legal, security, or leadership become involved? How will the team determine whether customers were affected?

The response should also match the severity of the issue. An awkward internal summary is not the same as exposing restricted information or sending an unauthorized promise to a customer.

A simple response plan prevents teams from improvising during a stressful situation. It also makes it easier to learn from the problem and improve the process.

Keep Governance Proportional to the Risk

Not every company needs an AI council and a hundred-page policy before it can test a use case.

A small internal pilot may only need a named owner, approved data sources, limited permissions, documented testing, and a regular review schedule. A customer-facing agent that can update records across several systems will need stronger oversight.

What matters is that the decisions are made intentionally.

Before an AI use case moves into production, the team should be able to answer a few practical questions:

• Who owns the outcome?
• What information can the AI access?
• What actions can it take?
• Where is approval required?
• How was it tested?
• How will the team monitor it?
• What happens when it makes a mistake?

If those answers are still unclear, the use case is probably not ready to scale.

Make AI Governance Part of the Salesforce Roadmap

AI governance works best when it is built into the Salesforce implementation from the beginning. Access, permissions, automation, testing, monitoring, and escalation all affect how the solution should be designed.

Starting with one focused use case gives the team room to learn. If the results are strong, the organization can gradually expand access or autonomy. If the results are weak, the team can address the data, process, or configuration problems before they spread.

It can be tempting to treat governance as something to figure out later. That usually creates more work. The decisions made early determine whether AI becomes a trusted part of the revenue process or another tool employees hesitate to use.

For a closer look at why these controls matter before adoption expands, read The Cost of Intelligence: Why AI Governance Needs to Come Before AI Scale.

Revenue Ops can help evaluate AI readiness, select the right Salesforce use case, and build the data, workflow, and governance foundation needed for a responsible rollout.