In the first dispatch of this series, I wrote that Salesforce would “put Agentforce 360 and Slack on a single slide and call it the agent stack.” I walked into the TDX 2026 keynote hall this morning expecting the maximalist bundle pitch — one contract, one console, one roadmap, one throat to choke. That prediction was partially right and meaningfully wrong.

They did pitch the bundle. But they also pitched the unbundle. Salesforce Headless 360 decomposes Customer 360 into REST and MCP endpoints, supports React alongside LWC, opens the agent harness to Anthropic and OpenAI SDKs, and deploys to ChatGPT, Gemini, and Claude — not just Slack. That’s not the story I was bracing for. It’s architecturally a more interesting one.

Nobody wrote a single line of Apex in the entire keynote. That’s the signal worth paying attention to.

What Salesforce Headless 360 Actually Is

Joe Enzella framed it through four core systems — System of Context (Data Cloud), System of Work (Sales, Service, Marketing), System of Agency (Agentforce), and System of Engagement (Slack, React, Mobile SDK, third-party LLM surfaces). All four are decomposed into headless endpoints. As Joe put it: “Every one of these systems is represented in these endpoints. And these endpoints are what you’re going to use — or more accurately the agents that are working on your behalf are going to use — to build both deterministic and probabilistic experiences.”

The lifecycle wraps those endpoints in a Build → Deploy infinity loop with governance at the center:

Build — Agent Script, Skills for Coding Agents, Agentforce Builder, AgentExchange. GA now.

Test & Eval — Custom Scoring/Evaluators, Testing Center. Beta today, Testing Center GA May ‘26.

Deploy — Enhanced Chat v2, Mobile SDK, AFDX CLI, Agent Script for Voice, Experience Layer. GA now, Experience Layer Beta July ‘26.

Observe — Session Trace (OTEL-compatible API), Telemetry in Slackbot. Beta today / GA now.

Experiment — A/B Testing API. Pilot today.

Control & Orchestrate — Multi-agent Orchestration, Agent Fabric. Beta now / GA now.

The table matters because it separates what’s production-real from what’s keynote-real. Agent Script, Agent Fabric, and multi-agent orchestration are GA. The Experience Layer — the most architecturally ambitious piece — is Beta July ‘26. React is beta now with GA expected by Dreamforce. The Testing Center ships in May. Some of this you can build on today. Some of it you can plan around. Some of it you can only watch.

The Open Standards Play

The keynote’s strongest architectural move wasn’t a feature. It was a concession.

Agentforce Vibes 2.0 ships with an open agent harness that supports the Anthropic Agent SDK and the OpenAI Agents SDK. Not BYO-LLM — BYO-entire-coding-agent. You can run Claude Code or OpenAI Agents inside the Agentforce trust layer with full access to 60+ MCP commands, all headless, all accessible from any tool you want to use. Claude Code, Cursor, Windsurf, VS Code — the keynote named them all by name. The quote from the stage: “You get the power of Claude Code and OpenAI agents tailored for Salesforce with these headless services all available running securely in the Agentforce trust layer.”

In the second dispatch, I noted that Vibes’ biggest limitation was its scope — Salesforce only, no cross-stack reach. The 60 MCP commands and the open harness are a direct answer to that criticism. Whether it’s a complete answer depends on how much of the MCP surface is GA today versus roadmap, which is a Day 2 question.

React support is the genuine surprise. Kush demoed a full React application running natively on the Salesforce platform — connected to org metadata via GraphQL, inheriting all security primitives, access models, and the full trust layer. His words: “This is not Lightning. This is React. This is the React that all of you know and love… natively running on the Salesforce platform.” If this ships as described — beta now, GA by Dreamforce — it breaks the LWC moat that has defined Salesforce frontend development for years. I didn’t predict this. It changes the developer-experience calculus from Post 2 in ways I need to think through.

Joe Enzella framed the ecosystem philosophy directly: “Agents hate boundaries. Agents do not like to stay in a silo. They want to talk to each other. They want to talk to endpoints.” That’s not just a design principle — it’s an explicit acknowledgment that the walled-garden model doesn’t work for agentic systems. The open ecosystem slide showed hyperscalers, AI natives, and consulting partners all using the same family of tools. Whether that ecosystem actually materializes at scale is a different question from whether the architecture supports it. The architecture, as described today, supports it.

The Agentforce Experience Layer — Define Once, Deploy Everywhere

The Experience Layer is the piece that most directly addresses my Post 1 concern about Slack lock-in. The keynote demoed the same agent deployed across six surfaces in one session: web, Slack, Microsoft Teams, mobile (via the Mobile SDK), ChatGPT, and Claude. Same rich interactive UI, adapted to each platform’s native patterns. Define the schema, layout, and actions once in the Experience Layer playground — low-code drag-and-drop or agent-generated components — and it renders natively on every surface.

Johnny, the Experience Layer lead, framed it as a fundamental shift: “You’re not pulling customers into your app anymore. You’re pushing your experience to wherever they already are.” They demoed Agentforce for Sales embedded directly inside ChatGPT — real-time account plans pulled from Agentforce, interactive, with follow-up queries. Not static cards. Live data.

Here’s why this matters for the opt-out architecture from Post 1. I wrote that “every team that adopts Slack-as-agent-UI is one more team whose muscle memory is tied to a Salesforce-owned surface.” Salesforce just told me — on stage, at their own conference — that agents can surface on ChatGPT, Gemini, Claude, and Teams. The conversational-surface lock-in argument I was making weakened meaningfully today. The lock-in shifts from where you deploy to how you build — which is a different bet with different exit costs.

The caveat: Experience Layer is Beta July ‘26. “Define once, deploy everywhere” is a keynote demo, not a shipped product. Beta to GA is not a formality. I want to see it under real traffic before I update the architecture recommendation from Post 1.

Revisiting the Post 1 Predictions

I brought specific predictions into this keynote. Here’s how they graded.

“Salesforce will put Agentforce 360 and Slack on a single slide and call it the agent stack.” Partially right. They did pitch Slack prominently — Slackbot synthesized an entire project channel’s discussions into a PRD that became the grounding document for the coding agent demo. But Headless 360 explicitly names six deployment surfaces. The single-slide-Slack-lock-in thesis was too narrow.

“BYO-LLM is technically supported but operationally discouraged.” They went further than I expected. BYO-entire-harness — not just the model, but the agent runtime. Claude Code and OpenAI Agents running inside the Agentforce trust layer is more open than “we support your inference endpoint.” I was wrong about the degree of openness here.

“Atlas will never be exposed as a service without Agentforce seats.” Still unaddressed. The keynote didn’t decouple Atlas from Agentforce. The reasoning engine remains coupled to the runtime. This prediction holds until proven otherwise.

“MuleSoft Agent Fabric maturity.” Confirmed. Agent Fabric and multi-agent orchestration are GA. The demo showed agents inside an org talking to each other — Service Agent flags a sales opportunity, SDR Agent picks it up. Nancy called it “1 plus 1 equals 3.” Implementation was literally “I click on the SDR agent, I click add, and voila.” Whether that simplicity survives a real enterprise’s agent topology is a production question, not an architecture one.

React support on the Salesforce platform. Not predicted. Didn’t see it coming. If React apps get first-class platform support with full security primitive inheritance, the LWC moat shrinks. That’s a genuine architectural shift I need to factor into the developer-experience assessment.

The Three-Layer Security Bet

The keynote doubled down on security with a three-tier architecture that maps to different threat surfaces of the agentic enterprise.

Layer 1 — Shield. The existing Salesforce security foundation — platform-level encryption, event monitoring, field audit trail — now extended to agentic workloads. This is the perimeter you already know if you run Salesforce today.

Layer 2 — Agentic Intelligence with Security Center. AI-specific security tooling. Agent behavior monitoring, anomaly detection, policy enforcement for probabilistic systems. Security Center becomes the governance console for agent security posture. This is the layer that acknowledges probabilistic agents need different security than deterministic workflows — you can’t just audit the code when the same input produces different outputs.

Layer 3 — Integrated Security Ecosystem with Security Mesh. Cross-platform security fabric connecting Salesforce security primitives with external security stacks. Not a walled garden — a mesh architecture that lets your SIEM, identity provider, and threat intel feeds participate in agent governance.

This directly addresses the honest admission from Post 1: replicating the Einstein Trust Layer on the Azure side is “a build, not a purchase.” If Security Mesh genuinely integrates with external security stacks — if my Azure security tooling can participate in Salesforce agent governance rather than running a parallel console — the opt-out architecture gets meaningfully easier. The dual-governance-console problem I flagged in Post 1 has a potential answer now. Whether Security Mesh delivers on that promise is a different question.

The Honest Admission

I’ve been writing this series from a skeptical-architect posture. Today’s keynote earned more credit than I expected to give it. The open harness, the React support, the MCP-first decomposition, the multi-surface Experience Layer — these are architecturally coherent moves, not marketing repackaging.

But keynotes are keynotes. The things I still don’t know:

How much of the “open” story survives contact with enterprise licensing? Open agent harness is compelling in a keynote. The pricing model will determine whether it’s compelling in a budget meeting. React is beta — beta is not GA, and Dreamforce is five months away. The LWC-to-React migration path is unspecified. Experience Layer is Beta July ‘26 — “define once, deploy everywhere” is a slide, not a shipped product. Agent Fabric GA does not equal Agent Fabric battle-tested under real multi-agent orchestration load. The $50 million AgentExchange fund is an ecosystem bet, and ecosystem bets take years to compound.

Joe dropped a framing that keeps nagging me: “With an agent, it’s 20% to get the thing out there, to make it great takes the 80% of the effort.” That’s probably right. Engine built their first agent in 12 days and it now handles 50% of support cases — but Engine also runs five agents with a dedicated feedback channel in Slack for continuous refinement. Who absorbs that 80% refinement cost on the corporate side, where the AI talent gap is already the number one blocker? Patrick Stokes acknowledged it directly: “55% of enterprise companies say that the biggest problem that they have is they do not have enough AI talent.” The tools got better today. The talent equation didn’t change.

What I Want to Find on Day 2

Four things I’m looking for on the TDX floor tomorrow.

Whether the open agent harness is genuinely runtime-agnostic or whether the Trust Layer gates which harnesses get full MCP access. The keynote said “any tool.” I want to see what “any” means in practice.

What the React-to-production path actually looks like. Can you deploy a React app to a Salesforce org today, or is it a sandbox-only beta with an asterisk the size of a release note?

Whether the Experience Layer supports custom components across ChatGPT, Gemini, and Claude — or whether it’s template-only rendering that looks good in a demo and constrains you in production.

And whether Agent Script is truly portable — version-controllable, reviewable in a PR, deployable from a CI/CD pipeline outside the Salesforce UI. Nancy said it’s a single flat file. A single flat file that lives in a git repo is a different architectural primitive than a single flat file that lives in a Salesforce org.

Sources

TDX 2026 Main Keynote (full video) · Speakers: Patrick Stokes (President & CMO), Joe Enzella, Nancy (VP of Agentforce), Kush, Johnny (Experience Layer) · Salesforce Agentforce · MuleSoft Agent Fabric

---

This is the fourth dispatch in the TDX 2026 series. The first, Salesforce Without the Full Buy-In, mapped the opt-out architecture before the keynote. The second, The Developer Experience You Can Bring Yourself, compared Agentforce Vibes against Claude Code. The third, The Practical Value of a Salesforce Certification, pressure-tested cert economics from the corporate side. More TDX reads coming as Day 2 unfolds.

Find me on X or LinkedIn. I write about what happens when AI infrastructure meets regulated reality.