What happened
Salesforce detailed Agentic Identity (reported Sept 22, 2026): external AI agents must be registered directly on the platform with their own credentials/permissions instead of running under a user's identity; each registered agent gets traceability, revocability, and separated policy controls, with successful MCP/API calls to count as Headless Platform Interactions against Flex Credits (multiplier TBA, 30 days' notice before metering; target availability around November).
Why it matters
It operationalizes the 'agents are non-human identities' control pattern at platform scale: short-lived, attributable, per-agent identities with complete traceability and revocation, replacing borrowed-user-identity access that weakens least privilege and audit. It also forces adoption by tying agent registration to the new consumption model, making agent identity governance mandatory for enterprise Salesforce estates.
Applicability
Salesforce platform owners should inventory agents and MCP clients now and plan for mandatory agent registration and OAuth-based Agentic Identity connections before the agentic metering/registration deadlines; IAM teams should include agent identities in non-human-identity programs.