Rohan Kumar’s Enterprise Harness Just Became a Product
Three weeks ago, Salesforce’s platform chief told me the harness “needs to be a unified product.” Today it has a name, six capabilities, a control plane, and a delivery window. It still has no price, and the control plane it needs most is the one the competition already ships.
SAN FRANCISCO, September 10, 2026. On August 19, I sat down with Rohan Kumar, Salesforce’s President and Chief Platform and Engineering Officer, and he described something he called the Enterprise Harness. I wrote that it was “a vision, not a roadmap. No SKU, no dates, no packaging.” I also wrote that it was the most important sentence in the interview.
This morning Salesforce lifted the embargo on the Trusted Enterprise AI Harness, and Kumar walked a handful of us through it on a press call yesterday. The vision now has a taxonomy: six “trusted” capabilities plus a new AI Control Plane. It has a window: rollout begins in what Salesforce calls “early fiscal FY28,” which on a normal calendar means February 2027 at the earliest, since Salesforce’s fiscal year starts February 1. It has a packaging philosophy: composable, pay for what you use, bring your own security vendor.
And it does not have a price, and Kumar admitted that two of the six capabilities are not built yet. Call it halfway from vision to roadmap, with Dreamforce six days out. It deserves a straight audit.
Table of contents
Why “Harness,” and Why the Coding Harness Isn’t Enough
If you write code with agents, you know the word. Claude Code, OpenAI Codex, and Cursor are harnesses: a model wrapped in a loop, a tool registry, a permission layer, and an evaluation feedback path. The discipline got its own name this year, harness engineering, after OpenAI’s February case study on shipping a million lines of code with Codex doing the typing. The model gets the headlines; the harness gets the merge.
Kumar’s argument is that this definition is a toy. Asked whether Salesforce’s harness was “a skill that adds onto a model,” he lit up.
“That’s the classic definition: I’m sitting inside an AI tool, there’s a set of skills, I write some agent code, I have a runtime, it looks at my evals,” he said. “We believe that’s very limited. Securing the agent, governing the agent, creating the actual context the agent relies on, this whole ecosystem of things has to come together.”
Then the line that will be quoted at Dreamforce whether Salesforce wants it or not: “The way Salesforce is defining the enterprise AI harness is the most comprehensive that I have seen.”
The translation: a coding harness is the inner ring, one model doing one job. The enterprise harness wraps that loop in context, governance, security, and cost accounting, then exposes it through headless APIs so any runtime can run inside. Kumar was explicit the inner ring is not where Salesforce intends to win: “Where you run your agents, the code of the agents, in my humble opinion, is going to become a commodity.”
That is my Second Law of VE Economics, Cognitive Commoditization, from the platform chief’s mouth without the label. I’ll take it.
Why Care About a Product That Ships Next February
A fair objection: a platform six months out with two capabilities unbuilt reads like a slide deck. Three reasons it is more than that.
The harness is where the money goes. Run the order question through a bare agent, say Claude with an MCP connection to your org and no context layer. It has to discover which of your forty custom objects holds entitlements, reconcile three definitions of “available” across CRM, ERP, and the warehouse feed, check the permission sets, and reason over all of it. Every time. Per token. Hand the same agent a curated context layer that already knows the entitlement schema, the canonical definition, and the permission boundary, and you get the same model, a fraction of the reasoning, and an answer the CISO will let it act on. Kumar in August: “Why are agents becoming so inefficient and expensive? Because they’re operating at a data layer that is not curated well.” Harness quality is the unit economics of every agent you deploy. Nobody has published the token gap between a raw agent and a curated one, and Salesforce should.
The frontier labs are not going to build this for you. Anthropic and OpenAI ship faster than Salesforce, so why not just ride them? Because the coding harness knows the repository, not your contracts, your discount policy, your identity graph, or which agent may touch the general ledger. Anthropic’s own answer is Claudeforce: it partnered for the enterprise layer rather than building it. The labs will keep winning the inner ring. Someone has to own the rings around it: Salesforce, ServiceNow, Microsoft, or a stack you assemble yourself.
The decisions lock in before February. Which system registers your agents, which catalog defines your terms, and whose identity graph agents run under are being decided this budget cycle, not next. The foundation pieces ship today. Kumar’s pitch is aimed at that decision: “Lots of vendors are saying we’ll help you do more with less, but it’s a margin play. Customers say, I get the efficiency piece. I want to grow my business. That opportunity is very unique to Salesforce.” Top line, not margin. Kumar, three months in after 28 years at Microsoft, says he took the job for that thesis and because Benioff is “in super founder mode right now.”
The Six Capabilities, in Kumar’s Words
Salesforce runs one example through all six: “Can we fulfill this order today?” CRM knows the relationship, ERP knows inventory, contracts hold entitlements, analytics holds the definitions, policy decides what can be promised. The harness lets an agent assemble the answer, act on it, and stay inside the rules.
- Trusted Context. Data, metadata, semantics, memory, and how work actually gets done. As Salesforce sources it, this is data-first: catalog, semantic model, CDP. What an agent needs also includes process, configuration, and intent, and that scope widens every time an agent is given more authority to act. Asked what the biggest obstacle is, Kumar said: “Do you understand your entire data estate? Where does it live? Is it clean? The first step is to get your data AI-ready, because if those sources are not clean and well understood, your agents are going to look at bad stuff.”
- Trusted Agency. Reasoning, planning, state, orchestration. “The builder harness, like what Agentforce or Flow is. Agency is about coming to a decision: look at the trusted context, look at the model, look at what the customer is asking, and come up with a set of decisions.”
- Trusted Action. Executes those decisions against applications, APIs, and workflows. Asked why it’s a separate box: “Every action needs to be governed, and then you capture the exhaust and increase the context of the enterprise. I may not want an agent to go update my CRM, because it could completely corrupt it.” Action is its own capability because action is where the CISO says no.
- Trusted Governance. Lineage, quality, guardrails, and policy over the data and processes AI depends on.
- Trusted Security. Identity, permissions, privacy, data protection, and runtime security, including agent identity and data classification.
- Trusted Models. Model routing on accuracy, performance, cost, and business requirements, so the enterprise can change models “as technology evolves.”
Note what shaped this list. It is an inventory of assets Salesforce owns, reorganized around agents, not a blank-sheet inventory of what an agent needs. Informatica’s catalog is “one of the best assets in the world” for understanding a data estate, in Kumar’s words, and it is a data asset.
The Control Plane Is the War
Above the six capabilities sits the AI Control Plane, the part Salesforce most needs and least has.
Think air traffic control. The tower knows every plane in its airspace, its type, heading, altitude, and fuel, and does not care which airline owns it. The picture changes every second, so it must be live. Every agent registered, model and cost profile known, permissions declared, token burn visible, whoever built it.
That is what Kumar described. “You’re going to open up the agent registry, it’s going to have a natural language interface, and you’re going to see a view organized around what the agents are costing you.” He called it “the evolution of our API management product, to manage things like your MCP servers, your LLM servers, an agent registry.” Here is where MuleSoft, a $6.5 billion purchase in 2018 for API management, turns out to be the coordinating technology of the agent era. Vision or luck, the asset is real.
A view of what your agents cost is a meter, and the meter is the small part of the job. Anyone who has run cloud FinOps knows the split: a sliver of the time watching the bill, the rest modeling cost before commitment and pricing the tradeoffs. For agents the levers are specific: which model handles which step, how much context loads per call, how often the agent may act, where a deterministic flow can replace a reasoning step. Kumar acknowledged the harder half: “We’re spending a lot of time with customers figuring out how do you evaluate what’s the actual business value for an agent. It’s not easy.” The announcement promises to “control cost.” Control means levers, and nothing described so far is one. Trusted Models routing is the single built-in lever, and it only pays off if the console can predict a change before you make it.
Now the hard part. ServiceNow has called itself “the AI control tower for business reinvention” since May, and its AI Control Tower is not a February 2027 item. It ships today, was extended at Knowledge 2026 with observability and value measurement, and governs agents across Microsoft Foundry, Copilot Studio, Microsoft Agent 365, and Amazon Bedrock AgentCore. Microsoft Agent 365 went GA May 1 with the same logic. Workday sells an “Agent System of Record.” Gartner published its first Guardian Agents market guide in February. This is a crowded tower.
Salesforce’s answer is that it owns the parts the others must integrate: customer data, semantic models, identity graph, API management, workflow logic. A real argument, and also the one a company makes when its console is a year out and the competitor’s is on the runway. ServiceNow, meanwhile, just bought Sweep, a Salesforce admin tool, and is not being polite about it.
The Fine Print
Kumar volunteered the most important caveat unprompted: “I wouldn’t say we have all the capabilities, just to be fair. Especially trusted security and the FinOps piece, there are things we need to go build.” The two capabilities the CISO and CFO care about most are the two on the drawing board.
One absence is worth naming. Salesforce Guardian is listed among the contributing technologies; that is the Security Center, Privacy Center, Shield, and Backup suite. The Einstein Trust Layer, two years the stated AI differentiator, is not named at all, presumably absorbed into Trusted Security and Trusted Models. Slack sits where it belongs: alongside Claude, ChatGPT, and Teams as a surface, one of the inner-ring harnesses with the enterprise harness underneath.
Then the word itself. Since my August interview, “harness” has done more work at Salesforce than a Clydesdale at a state fair. The Claudeforce announcement called AIforce “Salesforce’s trusted enterprise harness.” Benioff called AIforce “a new user interface harness” on the earnings call. Today’s announcement says the Enterprise AI Harness is “advancing the broader AIforce strategy.” Three harnesses in fifteen days, either a strategy or a drinking game. My reading: AIforce is the go-to-market umbrella and interface layer; the Enterprise AI Harness is the platform underneath.
What Advanced Since August 19
Claudeforce is the first shipping proof point: Claude as default reasoning engine, 37 sales skills as a plugin, GA around Dreamforce on premium editions. On the earnings call Benioff organized the company around four layers (data, applications and semantics, agents, interfaces) with the harness making them run together, and reported Agentforce ARR above $1.5 billion, a vendor figure.
The Builder Gap remains open, too. The announcement names three personas: data leaders, security leaders, and builders. Look for the word Trailblazer. It isn’t there.
What’s Missing
Score the harness as an architecture and it is coherent. Score the Enterprise AI Harness as a strategy and there are five holes, in rising order of difficulty.
- The admitted gaps. Trusted Security and FinOps are unbuilt. Agent identity, runtime security, and cost accounting are what a CISO and a CFO ask about first, and the answer through next spring is “coming.” That matters more under consumption pricing. A CFO asked to sign an open-ended Flex Credits commitment with no spend controls will not, and the FinOps gap is where that conversation dies.
- The console. A year out, against three shipping towers. A registry with a natural-language front end is table stakes. The differentiator must be what the registry knows about each agent’s context and permissions, and whether it can model cost ahead of deployment rather than meter it afterward.
- The composability proof. “Bring your own security vendor” and “pay only for what you use” have no demo, partner list, or price. Until a customer swaps a capability in public, composable is a slide.
- The people. Every persona named is a leader or a pro-code builder. The declarative admins who will register agents and curate semantic models are not in the document. Someone must be trained to run the tower.
- The why. Nobody in the industry, Salesforce included, has built this, and it matters most. The catalog holds the what. The semantic model defines the terms. The core platform encodes the how in twenty years of validation rules, flows, and Apex. None of it holds why: why that validation rule exists, why discount approval routes through finance in EMEA and not AMER, why the last three architects rejected the integration everyone keeps proposing. That knowledge lives in people’s heads, Slack threads, and contractors who rolled off in 2023. Every complicated IT system I have ever audited was drowning in what and starving for why.
An agent that inherits the what and the how without the why will follow the rule perfectly right up to the moment the rule should not apply, and it will have no way to know. Kumar’s “compounding intelligence loop,” where action exhaust flows back into context, is the right instinct. But exhaust records what happened, not what was intended. The context layer of the future has to capture intent at the point of decision and carry it forward, or the harness will govern agents that are fast, secure, cheap, and confidently wrong.
Vision to roadmap in three weeks. Roadmap to invoice is the true test, and there are no receipts yet. The why is the part nobody has started.
Vernon Keenan is CEO of Keenan Vision LLC and publisher of SalesforceDevops.net. Disclosure: Keenan Vision is a paid advisor to Salesforce and to other companies across the enterprise software and AI ecosystem. The views expressed here are the author’s own and were developed independently of those relationships. Quotations from the September 9 press briefing have been lightly edited for grammar and clarity.
