Salesforce Certified Agentforce Specialist AI-201: Spring '26 Study Guide

What AI-201 validates

The Salesforce Certified Agentforce Specialist credential targets people who design and implement prompt templates and agents on the Salesforce Platform. The official audience description emphasizes administrators, developers, and architects who configure Prompt Builder, ground experiences with Data 360, build agents, test them, move them from sandbox to production, observe outcomes, and understand multi-agent protocols. This is not an examination of transformer mathematics or foundation-model fine-tuning. It is an enterprise implementation exam: connect a business requirement to the correct governed platform behavior.

The official Spring '26 guide lists 60 multiple-choice questions plus up to five randomly integrated unscored questions, 105 minutes, a 72% passing score, and no prerequisite. It says successful candidates typically have one year of Salesforce platform configuration and standard-object experience, including practical use of Data 360, Agentforce Builder, Prompt Builder, Testing Center, and sandbox-to-production patterns. Platform Administrator and Platform App Builder are recommended certifications, not mandatory prerequisites.

The 50-question AI-201 practice bank uses exact counts of 10, 10, 17, 5, 5, and 3. Treat those counts as a study allocation, not a claim about any particular live test form.

Prompt engineering is a governed lifecycle

Start by deciding whether generation belongs in the workflow. Prompt Builder fits repeatable generative work that needs Salesforce context, controlled instructions, versioning, preview, activation, and supported invocation. A field-generation template is a natural match for drafting a supported record field. Flex templates support broader reusable prompt use cases. Neither should replace deterministic rules when the answer can be computed exactly.

A production prompt should name its role and task, identify permitted sources, define constraints, specify output structure, and state what to do when evidence is missing. For example, a warranty assistant should not infer contractual terms. It should report that approved evidence is unavailable and clarify or escalate. This behavior is testable; “be accurate” is not.

Grounding inserts relevant business context at execution time. The goal is not to maximize context volume. It is to retrieve the smallest authorized set that answers the task. Inspect resolved prompts with synthetic records, test both ordinary and restricted users, and score factual support, format, safety, and abstention. An administrator preview can mask missing runtime permissions.

The Einstein Trust Layer is a collection of controls rather than one safety switch. Official Salesforce documentation describes secure permission-aware retrieval, configurable data masking, prompt-defense policies, zero-data-retention arrangements with external model providers, toxicity scoring, and audit trails stored in Data 360. Teams remain responsible for access design, data minimization, model allowlists, retention, incident response, and human review.

Data 360 retrieval: source to evidence

An Agentforce Data Library organizes approved sources for retrieval. Follow the complete path: source content is ingested, split into chunks, indexed, searched by a retriever, inserted into grounded context, and used by the model. A failure at any stage can look like “the model was wrong,” so isolate the layer before changing prompts.

Chunking balances context and precision. A whole handbook as one chunk returns too much unrelated material. Arbitrary sentence fragments can lose exceptions and headings. Use coherent sections, preserve useful metadata, and evaluate against real paraphrases. Index freshness is equally important. If an approved policy changed but the active index did not, no instruction can make retrieval current.

Retrievers should be purpose-specific and permission-aware. An HR agent should not search a public product corpus and an external customer should not retrieve employee policy. Evaluate expected passage retrieval, no-answer requests, synonymous language, conflicting documents, stale content, access-denied content, and identity-resolution errors. When no acceptable evidence exists, the agent needs a designed clarification, abstention, or escalation path.

Agent Script, topics, actions, and hybrid reasoning

Topics organize coherent jobs. Their classification description determines when they apply; scope and instructions define boundaries; actions expose operations. An overloaded “support” topic containing billing, password reset, cancellation, and shipping actions makes routing harder and increases the blast radius. Split by coherent business responsibility and test utterances that should and should not enter each topic.

The Spring '26 outline specifically names next-generation authoring, Agent Script, Canvas, Script View, and hybrid reasoning. Hybrid reasoning combines flexible language understanding with deterministic controls. Let the model clarify a user's intent, but use validated variables, filters, template expressions, and explicit transitions for identity, eligibility, amount, confirmation, and write access. Keep the same checks in the action implementation; presentation-level gating is not authorization.

Prefer a standard action when it satisfies the requirement. A custom action is appropriate for a genuinely unsupported operation, but its contract should be narrow: typed inputs, least-privilege execution, server-side validation, idempotency for side effects, structured errors, timeouts, and audit correlation. If a reservation request times out after submission, blind retry can double-reserve. An idempotency key and status lookup let the agent reconcile safely.

Runtime security context is a frequent source of failure. Identify which user or agent context actually executes an action, which primary data permissions apply, and whether sharing and field-level restrictions are preserved. Test under the channel's real identity. Employee and Service agent categories guide the audience and use case, but they do not configure authorization by themselves.

Channels also change interaction semantics. Email is asynchronous and threaded. Voice has latency and turn-taking pressure and needs careful confirmation. Digital experiences require identity and session design. Slack has workspace and user context. Agent API is suitable when a custom application needs a supported programmatic conversation surface. Reuse capabilities where possible, but validate each channel's identity, formatting, handoff, and supported features.

Testing Center and deployment discipline

Testing Center should turn requirements into repeatable evaluations. Each case can specify input, expected topic, expected evidence, allowed or forbidden action, expected side effect, output criteria, and handoff behavior. Include happy paths, near-boundary values, ambiguous wording, restricted users, missing sources, stale sources, prompt injection, action errors, timeouts, cancellations, and replay.

A single percentage can be misleading. Segment results by topic, user persona, channel, model or template version, action, language, and risk. Review failures by layer: classification, retrieval, prompt, model, action contract, permission, data, or channel. Preserve the dataset and version so a seasonal release or configuration change can be compared against a baseline.

Deployment from sandbox to production is a dependency problem. Inventory the agent, topics, Agent Script, prompt templates, flows or code, actions, fields, objects, permissions, Data Library, indexes, retrievers, models, and channel bindings. Separate deployable metadata from environment-specific identifiers and secrets. Deploy inactive, map dependencies, test under the production runtime identity, use a bounded canary, monitor, and retain a rollback plan.

Governance and observability

Monitor outcomes, not only conversation count. Useful indicators include correct topic routing, grounded answer support, action success, side-effect reconciliation, human handoff, containment, latency, feedback, trust and toxicity signals, and cost. Aggregate trends should link to authorized traces that identify the deployed version and action path without retaining unnecessary personal data.

Optimization begins with a causal hypothesis. If one topic has high handoff after one custom action emits unhelpful errors, improve the action's structured error contract and recovery instructions, then compare the same evaluation set. Do not remove handoff merely to improve a containment metric. A lower escalation rate can be harmful if the agent begins making unsupported decisions.

High-impact changes need an owner, threat model, least-privilege runtime identity, representative tests, confirmation behavior, rollback, auditability, and monitored release. A compelling administrator demo proves only that one path can work. It does not prove permission safety, resilience, or production readiness.

MCP, A2A, and the multi-agent decision

Multi-agent architecture is justified when specialization, separate ownership, scalability, or control creates concrete value. It also adds more model calls, latency, context boundaries, credentials, partial failures, and traces. Establish a one-agent baseline first. If a single bounded agent satisfies the use case, multiple agents may be needless complexity.

Model Context Protocol provides a standard pattern for exposing tools and contextual resources to AI clients. Treat every MCP server as a privileged integration boundary: authenticate it, allowlist tools, validate schemas, constrain destinations, use least privilege, limit time and retries, and audit invocation. Never assume that an open protocol means an open trust policy.

Agent-to-Agent communication supports delegation between agents. A coordinator should send only necessary context under explicit capability contracts. It must know which identity authorizes the request, what the specialist may do, how timeout or refusal is represented, whether results conflict, and how traces correlate. Authorization should not expand transitively because one trusted agent calls another.

Practical study plan

Use the five-phase AI-201 roadmap. In the first two weeks, build and evaluate prompts and retrieval. In weeks three and four, create topic and action boundaries and test runtime security. In weeks five and six, build Testing Center suites and deployment manifests. In week seven, monitor and optimize a controlled canary. In week eight, build the multi-agent lab only after measuring a single-agent baseline.

The three AI-201 projects cover a grounded read-only service agent, a deterministic consequential-action lifecycle, and a governed MCP/A2A orchestration lab. Review the 40 flashcards with spaced repetition. Complete the 50 original questions under 105 minutes, then explain why each distractor belongs to the wrong layer or violates a security or lifecycle requirement.

Official references

• Salesforce Certified Agentforce Specialist credential
• Trailhead Academy AI-201 product page
• Salesforce Certified Agentforce Specialist Exam Guide
• Prompt Builder Basics
• Einstein Trust Layer
• Become an Agentblazer Champion 2026

Continue learning

• AI-201 roadmap
• 50 AI-201 questions
• 40 AI-201 flashcards
• Three AI-201 projects
• Agentic AI and MCP engineering roadmap
• Editorial policy

Frequently asked questions