Credential-based verification and Service run-as
Key Takeaway
A Service agent runs its actions as its agent user by default. Verifying a customer's identity doesn't change the run-as user. Only credential-based user verification on an Experience Cloud site switches the agent to the customer's own user record.
An Agentforce Service agent always runs its actions as some Salesforce user, and that user's access decides what data the agent can read and change. By default, it runs as a dedicated agent user. Credential-based user verification lets it run as the customer who is logged in to an Experience Cloud site instead. Knowing which user the agent runs as tells you where your security controls must live.
What an execution context is
Every agent action runs in an execution context. Agent types differ in who they run as:
| Agent type | Runs as |
|---|---|
| Employee agents | The logged-in employee |
| Lead Nurturing agents | A dedicated EinsteinSDRAgent User |
| Service agents | Depends on the channel and on whether credential-based user verification is turned on |
An Employee agent's access follows the logged-in employee's profile, permission sets, and sharing, so you don't need to scope its queries to user-specific data.
Service agents serve external customers and partners over enhanced Messaging channels. Enhanced Messaging channels support both authenticated and unauthenticated users.