Control the data boundary
Queries run with the connected Salesforce identity. Use a dedicated service account for shared credentials and give it only the object, field, and record access required. For personal credentials, Salesforce applies each user’s permissions. Also restrict which Salesforce objects are queryable in each Space, so Space membership and provider permissions jointly define access. Not every object or field is automatically available. Salesforce may require object permissions, field-level security, custom permissions, or configuration before a field can be queried. Custom field API names commonly end in__c; document business-specific relationships and mappings in the Agent instructions.