CRM data hygiene agents in Salesforce

A data hygiene agent in Salesforce reads sources your reps do not maintain, calls recordings, email threads, enrichment feeds, and proposes field updates that deterministic code applies under policy. Salesforce gives you more native infrastructure for doing this safely than any other CRM, and using it is most of the work.

What Salesforce gives you for free

Field History Tracking. Salesforce will record the old and new value of tracked fields, with a timestamp and the user who made the change, for up to 20 fields per object. Turn this on for every field an agent may write before the first write happens. It is the cheapest audit trail you will ever get and it is retroactive to nothing, so enabling it after an incident is worthless.

A dedicated integration user makes attribution automatic. Give the agent its own user, never a shared admin account. Then "show me everything the agent changed last week" is a report filtered on LastModifiedById, available immediately, with no custom logging.

Validation rules are a real safety net. They fire on API and automation writes, not just interface saves. A well-written validation rule will reject a malformed agent write at the platform level. Treat them as part of the guardrail layer rather than as an obstacle.

Field-level security constrains the agent for you. Remove edit access on the integration user's profile for every field the agent must not touch. This is stronger than any policy in your own code, because it holds even if the integration has a bug.

Which fields an agent should never write

The rule is anything that determines money or that a person is measured on. In a Salesforce org that means Amount, CloseDate, StageName on anything in a live forecast, OwnerId, and any field feeding commission. These have real consequences, low tolerance for silent error, and the automation upside is small next to the cost of one wrong value reaching a forecast.

Fields that are good candidates: NextStep, description and summary fields, industry and firmographic data, contact role, competitor, use case, and anything currently blank because entering it is tedious. The test is whether a wrong value costs an awkward correction or costs a quarter.

The Salesforce-specific failure modes

Overwriting a human is worse than leaving a field blank. The moment a rep sees the agent replace something they typed, they stop trusting the system and start working around it. Scope agent writes to empty fields first. Widen only where the agent has earned it on a specific field, and use LastModifiedById to tell whether the existing value came from a person or from the agent.

Triggers and flows cascade. An agent write is a save, and a save fires everything: triggers, flows, workflow rules, roll-up recalculations, and any outbound integration listening to that object. A hygiene agent updating a few thousand records can set off a chain nobody modeled, including emails to customers. Trace what fires on every object the agent will touch before you enable it, and run the first pass in a sandbox with the same automation active.

Governor limits punish record-at-a-time designs. Synchronous Apex permits 100 SOQL queries and 150 DML statements per transaction. Hygiene work is inherently bulk. Use batch processing from the start rather than discovering the limit during the first real run.

Duplicate rules and merges break attribution. Merging records discards field history on the losing record. If your agent audit trail depends entirely on field history, a merge quietly erases part of it. Keep your own append-only log alongside, not instead of, the platform's.

What to build first

Run the agent in proposal mode for two weeks before it writes anything. It produces the same decisions, writes them to a log rather than to records, and someone reads a sample daily. You will find out quickly whether the extraction is right, and you will find it out without having to undo anything. Teams that skip this step spend longer cleaning up than the review would have taken.

The general approach is in fixing CRM data quality with agents instead of nagging. The policy controls are in guardrails for AI agents that write to your CRM, implemented in crm-write-guard.

SYN.AUTON builds these systems. Salesforce Automation or tell us what you want to automate.