TL;DR
- Security teams can see only about a third of their real AI footprint (Snyk) but in the field it's often closer to 10–15%. Agents operate inside that blind spot.
- Permission drift (access that outlives its utility or reason) was tolerable when humans held the access. Autonomous agents inherit it and act on it at machine speed, including changing metadata, not just data.
- The fix requires continuous visibility into who (and what) can do what… so you find the exposure before your agents exercise it.
*****
New research from Snyk this month put a number on something security teams have felt for a while: they have visibility into roughly 33% of their organization's actual AI footprint.
Over the same six months, agentic architecture adoption bounced from 28% to 33%.
Smash those two lines together and the problem states itself: adoption is accelerating and visibility isn't.
Teams are, in a very real way, outrunning their headlights.
And, in fact, 33% may be the generous version.
Even that number is optimistic. In the field it was closer to 10–15%… and only at public companies with reporting standards forcing the question. When security teams finally started asking, most were so new to it they couldnt separate metadata and structure from data and records. That distinction is the whole ballgame.
It's the whole ballgame, indeed…. because agents don't just read.
They act.
What is permission drift?
Permission drift is what happens when access outlives its reason. A temporary elevation granted "just for this sprint" never gets pulled back. A role built for one job eventually morphs into a template for five others. A departed employee's permission set lingers, then gets inherited by the next hire.
Over-provisioned access (Modify All Data, View All Data, Delete rights) spreads because revoking it is riskier than leaving it alone.
In a vacuum, each of these is ordinary org housekeeping: the kind of debt every decent Salesforce admin on earth knows and most access reviews miss. Permission drift is a slow, invisible, gradual building-up of that debt across profiles, permission sets, and users until nobody can answer who can do what, and why.
How AI agents inherit permissions they were never scoped for
For years, drift was a governance annoyance. The reason it's now a security headline is simple: you can point an autonomous agent at the same org.
When you do, the agent inherits every permission humans never scoped — and it exercises them at machine speed, without the hesitation a person brings to "wait, should I actually be able to do this?" An agent doesn't know that the Delete right it inherited was a workaround from 2023. It just has it, and it will use it if a task calls for it.
"An agent just inherited a departed user's permissions — what happens next?" is no longer a thought experiment. In a production Agentforce org, it's a Tuesday.
Why shadow AI is worse than shadow IT
The reflex is to file this under shadow IT and reach for the familiar playbook. That underestimates it.
Shadow AI is worse. With shadow IT, the risk was mostly about location... where is our data being stored, shared, accessed? Contain the data, contain the problem. Shadow AI breaks that model. Now you have to understand three things about every agent: what it can access, what permissions it actually holds, and what it can do... create, modify, delete. And not just records. Metadata too.
That last point is the escalation. The risk isn't only what an agent can read — it's what it can change: fields, flows, permission sets, the scaffolding of the org itself. A misplaced file is a data problem you can contain. An agent quietly rewriting the structure of your org is a different category of threat, and it's the one the shadow-IT playbook has no page for.
Permission drift and Agentforce: why this is a now problem
Agentforce is live in production orgs today. That's what moves permission inheritance from an abstract "AI risk" slide into a concrete exposure you already have. The agents are already operating inside the access you've accumulated over years — you just haven't had a way to see the shape of it.
It also lands at exactly the moment security and compliance functions are being asked about agents in earnest. SOX and SOC 2 reviewers who never touched Salesforce internals are suddenly asking what an agent can reach and what it can change. "We ran a cleanup last year" is not an answer to a control that has to hold continuously.
You can't govern what you can't see. And by the numbers, most teams can't see the two-thirds that actually breaks things.
How to find and fix permission drift
Here's the trap: treat this as a one-time audit, sweep the org, declare victory. Drift doesn't work that way. Access keeps accumulating the moment the audit ends, so a point-in-time cleanup is stale before the quarter closes. The durable posture is continuous visibility and remediation — seeing access as it changes, not photographing it once.
A practical version of that motion looks like this:
- Inventory the real access, not the intended access. Start from live metadata — actual profiles, permission sets, and assignments — not last quarter's export or the org chart.
- Surface the over-provisioning that matters. Flag who holds Modify All Data, View All Data, Delete rights, and sensitive-object access, and trace why each path exists.
- Tie every finding to a fix. A finding without a remediation path is just anxiety. Each exposure should come with the change that closes it.
- Make it continuous. Re-run it on a cadence — or on change — so drift is caught while it's small.
This is where Sweep fits, and it's worth being precise about how: Sweep isn't a security product. It's the live context layer that makes these questions answerable in the first place. The Permissions Agent gives admins, security, and compliance teams a conversational way to interrogate Salesforce access — profiles, permission sets, user access, licenses, and sensitive permissions — and surfaces where over-provisioning creates risk, why an access path exists, and where it no longer should. It reads from live metadata rather than a point-in-time export, and it returns audit-ready answers instead of another spreadsheet to reconcile. With Playbooks, that whole investigation collapses into a single prompted motion you can run continuously, not only once a quarter.
From one-time cleanup to continuous visibility
The shift is simple to say and hard to do without the right layer: stop trying to clean the org up before the agents arrive, and start keeping it visible while they work.
Permission drift is measurable. The teams who come out ahead over the next twelve months are the ones who make measuring it continuous — and who find their vulnerabilities before their agents do.
FAQ
What is permission drift in Salesforce? Permission drift is the gradual accumulation of access that no longer maps to a current need — temporary elevations that were never revoked, inherited permission sets, and over-provisioned rights spread across profiles and users. It builds quietly until no one can confidently say who can do what.
Is shadow AI a real security risk or just a buzzword? It's real, and it's distinct from shadow IT. Shadow IT was mostly about where data lived. Shadow AI adds three harder questions about every agent: what it can access, what permissions it actually holds, and what it can do — including creating, modifying, or deleting metadata, not just records.
How do AI agents inherit permissions? Agents operate through the access model of the org and the identities they're granted. Where drift has left over-provisioned or orphaned permissions in place, an agent inherits those same rights and can act on them automatically, without the human judgment that previously kept unused access dormant.
How do you audit Salesforce permissions before deploying agents? Start from live metadata rather than a static export, surface over-provisioned and sensitive access (Modify All Data, View All Data, Delete rights), tie each finding to a remediation, and re-run the check continuously so new drift is caught early — rather than treating the audit as a one-time event.
Internal linking plan (not for publication)
Link OUT to (3–5):
- Playbooks — anchor: "a single prompted motion"
- Agent-risk series: Automation Interference — anchor: "a different category of threat"
- Agentforce readiness hub — anchor: "production Agentforce org"
Link IN from (2–3): (existing pages that should point to this post)
- Agentforce readiness hub
- Security-lane post: The New Economics of Salesforce Exposure
