LinkedIn
"Give Billy read-only access to this Case until next Monday at 1pm." Salesforce is very good at controlling who can see a record - but what if they should only have that access temporarily? AccessMate uses Agentforce as the conversational front door for governed, time-limited record access.
What it does:
- Applies configurable access policy and gets approval where required
- Grants the right level of Case Team access
- Removes it automatically when it expires
- Verifies the user really can no longer see the Case - and flags any other sharing that still gives access
- Shows operators the full access lifecycle in a small read-only component
- Runs in a safe "dry run" mode until the organisation is ready to switch it on
Getting "next Monday at 1pm" exactly right mattered: expire access an hour early and someone can't do their job, an hour late and they keep access longer than approved. A small Apex action gives the agent the user's local date, time and time zone, so expiry times are right even when the clocks change. Policy lives in configuration rather than code, and custom permissions control who can do what.
Policy the agent cannot override
The agent does not decide the policy. The rules live in custom metadata: for each Case classification and persona, the maximum access level, the maximum duration, whether approval is needed and how access is given. For example, a Supporting Case Worker on a Confidential Case can have Read Only access for up to 14 days, through the Case Team, with the Case Owner's approval. Ask for 30 days and AccessMate refuses before any request is created.
Agentforce interprets, configuration governs, Salesforce executes
The responsibilities are deliberately separated. Agentforce understands the request and keeps the experience conversational. Configuration defines the rules. Flow and Apex make the controlled changes and verify the result.
Approval works the same way. The approver must be the Case Owner and hold the AccessMate Approve Access custom permission. After approval, the agent re-reads the request and only confirms once its status really is Applied.
Removing access is not the same as access being gone
When access is revoked or expires, AccessMate removes only the sharing it created and tracked: the Case Team membership and any Manual CaseShare records of its own. It leaves unrelated sharing alone. It then checks the user's effective access rather than assuming the job is done.
If the user can still read the Case through some other route, AccessMate reports that unexpected access remains and records an Access Finding for someone to investigate. It does not invent the source when it does not know it.
Two records, two purposes
Every governed request is recorded as an Access Request, the governance record. Anything unexpected is recorded as an Access Finding, the assurance record. A small Access Overview component on the Case shows both, and it is deliberately read-only, so it never becomes another route for changing access.
What I would tell another team
- Put policy in configuration the agent reads, not in the prompt
- Have the agent check the final state before it says something worked
- Verify the outcome rather than assuming it
- Only undo what you own
I design, build and review agents like this as an Agentforce consultant in the UK.