Salesforce lays out a “human-in-the-driver-seat” model for AI agents that can act, not just answer

Salesforce is pressing a clear message to enterprises exploring AI agents that can take actions across business systems: giving agents autonomy does not have to mean giving them the steering wheel. In a recent interview on Salesforce’s newsroom, Kathy Baxter, the company’s Principal Architect of Ethical AI Practice, argues that today’s large language models, which power agent chat and reasoning, are probabilistic and can both hallucinate and trigger wrong actions if deployed without guardrails.

Baxter’s central concept is an architecture that splits an “agent brain” into two layers. In her description, the first layer is generative, using an LLM to interpret instructions and predict the most likely answer based on context. The second layer is deterministic, where consequential decisions are routed through preset business workflows, policies, permissions, and escalation paths that the enterprise defines.

The practical implication is that even if an agent produces an output confidently, the system can require that any outcome with downstream impact be vetted by deterministic logic before it is executed. Baxter characterizes the approach as “inspectable” because the deterministic layer is implemented through Salesforce-controlled constructs, including Salesforce Code, Apex, and components she links to Agent Fabric, Flow, and Apex. That routing, she says, makes agent actions subject to “company-prescribed policies, procedures, or escalations to humans,” rather than letting the agent decide on its own what it thinks is best.

To address the dual risk of incorrect answers and compounding mistakes, Baxter points to grounding, verification, and auditability. She says agents need to be grounded in an organization’s specific data to reduce the chances of hallucination translating into incorrect behavior. She also describes an Atlas Reasoning Engine that requires agents to explain each action so that responses can be checked, not merely believed. An audit trail is part of the same accountability loop, recording what the agent did and what humans did afterward.

Salesforce’s approach also emphasizes who is responsible for the final call. Baxter frames the philosophy as “human in the driver’s seat,” rather than simply “human in the loop.” She describes a workflow where the system shows what the AI provided, what the agent then did, and what the human operator did next, including whether the human edited or submitted agent-generated content and captured feedback for later review by Salesforce administrators.

Beyond decision routing and explanation, Baxter points to additional safety controls. She says Salesforce’s responsible agentic AI guidelines include a requirement that agents identify themselves as AI agents and not present themselves as humans. She also references a “Trust Layer” designed to detect issues such as toxicity and prompt injection, which are techniques that can manipulate an agent’s behavior via malicious or misleading instructions.

For governance and performance assurance, Baxter highlights Salesforce’s Testing Center. In her account, the tool is meant to let customers evaluate responses using their own data, test for consistent and fair behavior, and apply customizable controls to specify what data an agent can use for decisions. She connects these controls to bias reduction by limiting data inputs that could introduce skew into agent outputs.

Baxter also warns that launch testing is not the finish line. She says a key gap occurs when customers test before going live but stop monitoring afterward. Because probabilistic systems can change in effect over time, she argues that continuous monitoring of agent performance is critical to maintaining safety and delivering stable experiences.

Looking ahead, the question for enterprises is how to translate the principles into day-to-day operations, especially as AI agents expand from customer-facing assistance into workflows that touch permissions, customer records, and business processes. Salesforce’s explanation centers on making agent behavior auditable, explainable, and bound by deterministic controls, but it does not specify which metrics organizations should track or how quickly they must respond when agent behavior drifts. For buyers, what to watch next is how Salesforce’s “two-layer” approach maps to specific product capabilities, and how widely it can help customers demonstrate compliance and operational accountability as agent use broadens.