Salesforce org audit glossary

Agentforce

Salesforce's platform for AI agents that answer questions and take actions inside an org. An agent works from the org's metadata and data, and acts through flows and Apex with the permissions it is given.

Agentforce readiness

How prepared an org is for agents to work in it. It has two parts: whether Agentforce can run at all (licenses and settings), and whether the org's setup is something an agent can understand and act on safely. VanguardOps scores the second part from 0 to 100 and checks the license for the first.

Apex trigger

Code that runs when records on an object are created, changed or deleted. Triggers on the same object as flows and workflow rules are a common source of automation that's hard to predict.

API version

Every Apex class and trigger is saved against a Salesforce API version. Salesforce retires old versions; code on version 30.0 or older is on a retired one. Old versions are a sign of code nobody has touched in years.

Carrying cost

The yearly cost of leaving a problem in place: the extra upkeep it causes plus a risk-weighted allowance for what it could break. In the VanguardOps cost model it ranges from $600 a year for missing documentation to $8,500 a year for a security risk.

Connected app

A registration that lets an outside application reach a Salesforce org through its APIs. Audits look at which ones have full access, which haven't been used in a long time and which have no IP restrictions.

Data 360

Salesforce's customer data platform, called Data Cloud until Salesforce renamed it. Agentforce uses it to ground answers and record usage.

Flow

Salesforce's current tool for automation without code. It replaced workflow rules and Process Builder, and it is also one of the ways an Agentforce agent takes action.

Health score

A single number summarizing the state of an org. In VanguardOps it runs from 0 to 100 with a letter grade, and it is set by the AI's review of the org's metadata. The dollar figures beside it come from a fixed formula, not from the AI.

Invocable method

An Apex method marked so that flows and agents can call it as an action. If none exist, custom agent actions have to be built as flows.

Metadata

The description of how an org is built: its objects, fields, automation, code, permissions and integrations. It is separate from the records themselves, such as the accounts and contacts.

Metadata audit

A review of how an org is built, done by reading its metadata instead of its records. It can find tangled automation, unused access and aging code. It can't judge the quality of the data in the records.

Named credential

A stored endpoint and login that Salesforce uses to call an outside system. Ones still using basic authentication (a username and password) are a common audit finding.

OAuth scope

What an outside app is allowed to do once you authorize it. VanguardOps asks for two: api and refresh_token. The api scope is broad enough to read records, so VanguardOps limits itself to metadata in its own code and tests for it.

Permission set

A bundle of permissions you can assign to users on top of their profile. Over time orgs collect permission sets nobody holds and ones nobody can explain.

Process Builder

An older Salesforce automation tool. Salesforce ended support for it on December 31, 2025. Existing processes still run, but bugs won't be fixed, so they should be moved to Flow.

Record-triggered flow

A flow that starts when a record is created, updated or deleted. It is what workflow rules and Process Builder processes are migrated to. Before-save flows update the same record quickly; after-save flows do everything else.

Sandbox

A copy of a production org used for building and testing. Changes belong there first. VanguardOps only allows fixes to run in a sandbox; sandboxes can't connect yet, so today it only reads.

Stacked automation

Two or more automations, such as flows, triggers and workflow rules, that fire on the same object at the same moment. They run in an order that's hard to predict, and changing one can break another.

Technical debt (Salesforce)

The accumulated cost of shortcuts and leftovers in how an org was built: automation layered on automation, unused fields and permission sets, old code, undocumented integrations. You pay for it in slower projects and riskier releases.

3-year cost

What a finding is estimated to cost if nothing changes for three years: its yearly carrying cost times three. VanguardOps reports it beside the one-time cost to fix, so the two can be compared.

Tooling API

A Salesforce API for reading setup information such as Apex classes, flows and validation rules. It is one of the standard APIs a metadata audit uses.

Validation rule

A formula that blocks a record from saving when a condition is met, with an error message. Long, deeply nested rules are hard for people and agents to work around.

Workflow rule

Salesforce's oldest automation tool. Support ended on December 31, 2025, the same day as Process Builder. Active rules still fire and should be moved to Flow.

The numbers behind the cost terms are on what technical debt costs, and the readiness terms on how the readiness score is calculated.