Data governance becomes more consequential when business data does more than support reports. It can now inform AI agents, analytics, customer segmentation, and activations in other systems. If data is incomplete, poorly classified, or accessible to the wrong users or agents, the risks can include privacy exposure, compliance challenges, and reduced confidence in AI-driven decisions.

Salesforce Data 360 governance provides capabilities to classify data, define access policies, and apply controls across supported data and use cases. Informatica adds a broader enterprise data management portfolio to Salesforce’s strategic direction. Buyers should understand both what is available in Data 360 today and what Salesforce has announced about its evolving integration roadmap.

For a broader overview of the product family, see our detailed guide to Salesforce Data 360 and its products.

Why governance matters when data powers AI and activation

Organizations increasingly work with a mix of CRM records, warehouse data, documents, conversations, and other unstructured content. That context can support analytics and personalized experiences, but it also increases the number of places where access and usage need to be managed.

The concern is not simply whether a record is accurate. Leaders also need to know what the data represents, whether its use is permitted, which people or systems can access it, and how access can be reviewed later. Documents processed through document AI, for example, may produce structured information that is then used in workflows or agent responses. Classification and permissions help determine whether that information is appropriate for each use.

Salesforce’s Data 360 Governance overview describes capabilities for structured and unstructured data, policy-based controls, private connections, and encryption key management. The practical goal is to make governance a part of how data is accessed and used, not just a review performed after data has already been activated.

Three governance layers to consider in Data 360

1. Classification and metadata

Data 360 can automatically tag and classify unified data and metadata, including AI-recommended labels for categories such as PII, GDPR, or HIPAA. These labels provide useful context for defining policies. Classification does not, by itself, determine that data is accurate or that a particular use is legally permitted; organizations still need to establish appropriate definitions and review processes.

2. Policy-based access and use

Data 360 governance supports fine-grained policy-based controls that can apply across field, object, and record levels. Salesforce describes policies applying consistently across Data 360 use cases such as Agentforce, analytics, and segmentation, including ingested and zero-copy data. Admins can author and manage policies through the platform; implementation details and available controls depend on the architecture and product configuration.

For external sources, buyers should confirm how Data 360 policies interact with the source system’s own identity, permissions, and governance controls. A unified view does not necessarily remove the need to review the underlying system’s access model.

3. Security, connectivity, and encryption

Salesforce describes Private Connect for Data 360 as a way to establish private connections to external sources, including data lakes and warehouses. Data 360 also offers flexible encryption key management options, including customer- or externally managed keys and integration with AWS Key Management Service. Organizations should evaluate these options against their security architecture and operational responsibilities.

Data 360 governance is distinct from a complete enterprise data management program. Data quality, master data management, privacy practices, consent, retention, and source-system controls still need clear ownership.

For help translating these capabilities into a workable Salesforce design, explore our Salesforce services or schedule a call.

Governance in the agentic era: permissions and accountability

AI agents can read and act on data at machine speed. That changes the governance discussion: leaders need to consider both what an agent can access and what it is allowed to do with that information. A well-designed permission model can limit an agent to relevant, approved context, while human escalation rules can define when a request requires review.

Salesforce’s governance documentation describes policies intended to control access and usage across Data 360 and applications that consume its data. In practice, teams should confirm the enforcement path for each use case: which permissions apply at the point of access, how the connected source participates, and how actions are logged. Audit trails and periodic reviews help teams evaluate whether controls operate as intended.

This is particularly important when an agent draws on hybrid data: from Salesforce alongside a warehouse, lake, or ERP system. For example, an integration involving Salesforce and Oracle Fusion can make finance or inventory context available to business workflows. The integration should be considered alongside the data access, quality, and audit policies governing that information. See our Salesforce and Oracle Fusion integration services for more on connecting Salesforce with back-office systems.

For teams evaluating AI use cases, our Salesforce artificial intelligence overview provides additional context on Agentforce. Salesforce’s AIforce announcement also highlights how existing Salesforce permissions and business rules relate to agents and AI interfaces.

What the Informatica acquisition means for Salesforce buyers

Salesforce completed its acquisition of Informatica on November 18, 2025, in Q4 of Salesforce fiscal 2026. In its acquisition announcement, Salesforce said Informatica brings enterprise capabilities in data integration, data quality, governance, privacy, metadata management, data cataloging, and master data management (MDM).

The strategic direction is to bring Informatica’s enterprise data management capabilities together with Salesforce’s Data 360 context platform. Salesforce has described plans around integrating data integration, quality, governance, and unified metadata, as well as a data pipeline with MDM on Data 360.

The roadmap and product packaging are evolving. Buyers should not assume every Informatica capability is already embedded in Data 360, included in a particular license, or available through a specific integration. Confirm current availability, product names, implementation requirements, and commercial terms with Salesforce before making purchasing decisions.

Practical implications for buyers

A sensible sequence is to establish data quality before relying on AI outputs, classify sensitive data before activation, and design policy enforcement for the full hybrid landscape, not only Salesforce. MDM can help establish trusted master records for customers, products, or suppliers when records are fragmented across systems. Informatica’s capabilities may be relevant to that broader program, while the exact Salesforce integration path should be confirmed against the current roadmap.

A practical seven-point Salesforce data governance checklist

Use this checklist to start a governance review:

1. Build a classification inventory. Identify important structured and unstructured data, its source, sensitivity, business owner, and intended uses.
2. Design access policies. Define which roles, applications, and agents may view, use, or act on each data category.
3. Review consent and purpose. Confirm that consent, preferences, and permitted use are considered before segmentation or external activation.
4. Set retention and deletion rules. Assign owners and clarify how retention requirements apply across Salesforce and connected systems.
5. Make key management decisions. Evaluate Salesforce-managed, customer-managed, or external key options against security and operational needs.
6. Review agent permissions. Map each agent’s data access and actions to a defined business purpose, with escalation paths for sensitive requests.
7. Establish an audit cadence. Review access logs, policy changes, classification quality, and exceptions on a schedule that fits the risk and regulatory context.

How CloudStreet can help

At CloudStreet, we implement Salesforce solutions with a focus on business outcomes. Our work can include helping teams define governance frameworks, classify data, design policies, and integrate data quality practices into Salesforce implementations. For a detailed look at our delivery approach, see Salesforce Data 360 Implementation Services. We are based in Houston, Texas, and support customers locally and globally.

If you are assessing governance for Data 360, Agentforce, or a hybrid data environment, contact our team to discuss your architecture and priorities. You can also request a quote for Salesforce services.

Category: Blog
Label: Agentforce Commerce