Salesforce Integration Security Baseline

Overview

Build a shared-responsibility control set that connects the external application, Salesforce org, principal, data, event, and operational boundaries.

Prerequisites

• System context, data classes, org topology, app type, principal, APIs, events, and support paths
• Current customer security policy, Salesforce security documentation, and threat model
• Identity, security, Salesforce administration, privacy, data, application, and incident owners

Tool Discipline

Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts.

Current Contract

Salesforce access combines OAuth client policy, user or integration-principal permissions, object CRUD, field-level access, record sharing, org settings, and optional security products. Controls and entitlements must be verified in the target org.