Salesforce moved the seller's workday into Claude, and shipped it without a price. When "Salesforce in Claude" opens to public beta in September, your reps stop clicking through Lightning and start asking a chat window to review the pipeline — and two separate consumption meters begin running against your org at the same time. One of them is capped by your Salesforce edition and will throttle you. The other is billed by Anthropic on a contract you have not signed yet, and it has no ceiling at all.
That is the whole decision in front of the RevOps lead and the CIO this quarter. Not whether the product is good — early signals say it is genuinely useful — but whether you switch it on before you know what a pipeline review costs, who is on the invoice, and what your sellers' OAuth grant actually reaches.
What Actually Ships in September
Claudeforce is three separate things wearing one brand name, and only one of them is new to you.
Salesforce and Anthropic announced Claudeforce on 26 August 2026, alongside Q2 FY27 earnings. The three pieces: Claude as the reasoning model inside Agentforce's Atlas engine (already live), Claude as the default model in Slack, and the piece that changes your architecture — "Salesforce in Claude," a plugin shipping with 37 prebuilt sales skills, available to select pilot customers now and expected in open beta in September, with additional prebuilt skills beginning to launch in late 2026.
The skills are the familiar seller loop: meeting prep, deal health review, pipeline review. Salesforce president of applications and marketing Patrick Stokes framed the value in clicks. Evaluating and synthesizing a book of records, he told VentureBeat, "is like 10,000 clicks inside of Salesforce. Now you just go to Claude and it's going to execute all of that for you… in like 30 seconds." His pitch for the platform is unusually candid about where Salesforce thinks its moat is: "The value of Salesforce is not in our UI itself… It's in the data and the metadata, the years worth of kind of encoded workflows and business practices."
Underneath, this runs on infrastructure that has been in beta since July. The plugin is built on the Headless 360 hosted MCP server, which exposes exactly four tools — Discover (semantic search over available operations, returning up to 50 ranked results), Describe (the technical spec for a chosen operation), Dispatch (executes it, with GET, POST, PUT, DELETE and PATCH), and Dispatch Read-Only (GET only). Salesforce's own launch post says the beta opened with roughly 100 skills, expanding to thousands. One line from the announcement is worth reading carefully, because practitioner write-ups have already applied it to the wrong thing: Claude is available within what Salesforce calls its Trust Boundary through Amazon Bedrock — but that sentence sits in the announcement's Claude inside Salesforce section, describing the Agentforce path. It is not a statement about this plugin. No primary source puts the plugin's inference inside that boundary, and the separate Anthropic contract is good evidence it does not. Per TechTarget's reporting, Salesforce data is not retained in Claude and is not used for model training.
This is the same architecture we covered when Headless 360 first made the Salesforce UI optional. What changed in August is that a name-brand consumer surface is now the front end for it.
Two Meters Run at Once. Only One Has a Ceiling.
You will be metered twice for the same seller action, by two vendors, on two contracts, in two units.
Stokes said this out loud. "You can't buy this on one piece of paper at the moment," he told VentureBeat. Salesforce charges through headless consumption pricing tied to your license edition — "depending on your edition of your user license within Salesforce, you effectively get more incremental access to more and more API calls" — while customers contract separately with Anthropic for the Claude inference itself. The official announcement's only pricing language is that "pricing and packaging are subject to change."
The two meters fail in opposite directions, and that asymmetry is the thing to plan around.
Salesforce's meter throttles. MCP tool calls are API calls. Salesforce's platform API allocation gives Enterprise Edition 1,000 calls per license per 24 hours and Unlimited 5,000, with an org floor of "100,000 + (number of licenses x calls per license type) + purchased API Call Add-Ons" — and critically, limits are "enforced against the aggregate of all API calls made to the org in a 24-hour period," not per user. Hosted MCP traffic lands in that same bucket as your ETL job, your marketing automation and your warehouse sync. As one practitioner analysis of MCP versus REST puts it: "MCP tool calls count against the org's daily limit, same as REST calls," and "agentic workflows issue multiple sequential API calls per user action; the math changes quickly." A Discover → Describe → Dispatch loop is several calls before the underlying record reads even start. Hit that ceiling and your integrations fail, not just your agents.
Anthropic's meter bills. No cap, no throttle, an invoice. Anthropic's published Enterprise plan is a seat price plus usage at API rates, with a documented minimum of 20 seats billed annually and mid-term additions prorated and charged immediately. Team seats, the visible floor, are $20 per user per month annually or $25 monthly. The usage sits on top at published API rates: Claude Sonnet 5 at $2 per million input tokens and $10 per million output, Claude Opus 5 at $5 and $25, with cache reads at 10% of base input.
Nobody has published a per-skill number, so here is the arithmetic at list rates. Take a deal-health review that accumulates roughly 350,000 cumulative input tokens across an eight-turn agent loop and emits 12,000 output tokens. On Sonnet 5 with no caching that is about $0.82; with 80% cache hits it drops to roughly $0.32. On Opus 5 with no caching it is about $2.05. Now run 200 sellers at six skill invocations a day, 22 working days: 26,400 runs a month, which is somewhere between $101,000 and $649,000 a year depending on which model routes and whether prompt caching is on.
That is a 6.4x spread on identical headcount, and none of it is a Salesforce line item. It is entirely a function of routing and cache-hit rate — two settings nobody in your sales org will ever see. This is the exact failure mode we mapped in the agentic pricing buyer's guide: consumption without a cap is not a price, it is a range.
Stokes offered the reassuring version, and it deserves a fair hearing. Token consumption for this workload, he told CIO, "is certainly not zero, but it is nowhere close to approaching the amount of consumption that you would find in a development use case." That is almost certainly true — a pipeline review is not a coding agent chewing a repository. But "less than a coding agent" is a comparison, not a budget line, and the same managed-gateway gap applies here: no vendor in this stack is going to stop your spend for you.
The Permission Model Is Better Than You Fear. The Blast Radius Is Wider.
Record-level security genuinely carries over — and that is not the risk.
Steel-man first, because the obvious worry is wrong. Salesforce Hosted MCP does not run on a service account. Salesforce's own security guidance is explicit: only the OAuth authorization code flow is supported, there are no machine-to-machine flows, and "the human remains in the loop to connect to the org and grant access." Every tool call executes with the permissions of the user who authenticated. The Headless 360 reference confirms the enforcement stack: "Object permissions (CRUD), field-level security (FLS), sharing rules, profile permissions, and permission sets all apply," and every action is audited back to that user's account. A rep cannot ask Claude for a record they could not open in Lightning.
The risk is that the agent inherits everything the user has, including the permissions they have never once exercised through a UI.
Headless 360's beta skill library includes Setup operations — Salesforce's own launch post lists user management, Apex trigger deployment, event-driven integrations, and named credential creation among the initial capabilities. Named credential creation is a data-egress primitive. Apex trigger deployment is production code. A sales ops admin carrying an over-provisioned profile has always technically had those rights; they were just buried under forty clicks of Setup navigation that nobody stumbles into by accident. Natural language removes that friction entirely. This is the same shape as Snowflake agents inheriting every role their caller holds — the permission model is working exactly as designed, and the designed behaviour is the problem.
Three more things from the documentation that will not survive a default install:
- Scope choice matters more than anything else on the setup screen. Salesforce tells you to use the narrow
mcp_apiscope, not the broad "Manage user data via APIs" (api) scope, because it is "preferable to only expose a limited set of 'safe' operations to agents via MCP rather than to allow full API access." That is a one-click difference with a very large delta. - Tool annotations are hints, not enforcement. Salesforce's best-practice guidance states plainly that
readOnlyHintanddestructiveHint"are hints, not enforcement. Not all clients read or respect them." If your control for "don't let it delete things" is an annotation, you have no control. Activate Dispatch Read-Only and leave write Dispatch off until a pilot proves you need it. - Refresh tokens default to a one-year lifetime. Salesforce recommends shortening it. A year-long grant tied to a seller's full CRM permissions, held by an external client, is not a token you want outliving their tenure.
Then there is the second path. Practitioner teardowns of the release note that while the plugin uses per-user OAuth, Claude Tag — one of the Claude-powered surfaces in Slack — runs a client credentials flow with a dedicated integration user. Two paths into the same data with two different identity models, under one product name. Whatever you conclude about the plugin's permissions does not automatically transfer to the Slack surfaces — and agent identity is still split across issuance and governance in every stack we have looked at. Audit them separately. Event Monitoring is where you check: filter on API_CLIENT_CATEGORY matching SALESFORCE_HOSTED_MCP.
Salesforce Already Told You It Cannot Measure the Value
The metric Salesforce reports for agent work counts execution, not outcomes — which means it will not settle your renewal argument.
The same earnings call that launched Claudeforce reported Agentforce ARR above $1.5 billion, up over 240% year over year, combined Agentforce and Data 360 ARR near $3.9 billion, and 7.0 billion Agentic Work Units delivered to date, with 3.2 billion in Q2 alone, growing 97% quarter over quarter. Salesforce defines an AWU as "a measure of discrete tasks executed by AI agents in production across the Salesforce platform." Revenue guidance for FY27 went up $200 million to $46.1–46.4 billion.
An AWU is the unit you will end up arguing about. It is also, per a fairly unanimous analyst read, not fit for that argument. CIO's roundup of the metric is worth quoting because these are the people your board will be reading. Robert Kramer of Moor Insights and Strategy: "AWU measures execution rather than accuracy. A triggered workflow or an API call counts, regardless of whether the agent resolved the issue correctly." Sanchit Vir Gogia of Greyhound Research is sharper: "At scale, agent retry behavior and exception handling are inevitable… Without explicit classification between attempted, succeeded, accepted and validated actions, AWU remains a throughput metric rather than a trust metric."
Read that alongside the pricing structure and the shape becomes clear. Both meters count attempts. A retried Dispatch is an API call against your org allocation, a token spend on Anthropic's invoice, and — if it completes — an AWU in Salesforce's disclosure. None of the three units distinguishes a successful deal review from a failed one that ran three times. If you want cost-per-useful-outcome, you will have to instrument it yourself, the same way Toyota's platform team had to define what an inherited security review actually covered before they could reuse one across fifty agents.
Constellation Research's Liz Miller, who was broadly positive on the integration itself — "this now brings exactly what people want, and what they're already using, into the platforms where they want to work" — is equally direct that AWUs "don't necessarily define success for a Salesforce customer."
What to Do Before the Open Beta
The September beta lands inside your Winter '27 upgrade window, which is a scheduling problem before it is a technology one. Per Salesforce Ben's release calendar, sandbox preview lands around 29 August 2026 and production instances upgrade on one of three weekends — 29 August, 3 October or 10 October 2026 — assigned by instance. You cannot decline or delay the production upgrade. Do not debug a beta plugin and a platform release in the same week.
This Week:
- Look up your instance's Winter '27 production date on Salesforce Trust. Write it on the same page as the September beta date. If they are within a week of each other, your beta start moves.
- Pull 30 days of API-call consumption for the org and compute your headroom. The formula is 100,000 + (licenses × 1,000 for Enterprise Edition, 5,000 for Unlimited). Subtract what your existing integrations already burn. What is left is your entire agentic budget, shared, and enforced org-wide.
- Get the Anthropic paper started. Enterprise is seat price plus usage at API rates with a 20-seat minimum billed annually. Procurement cannot negotiate a rate card that has not been requested, and September is three weeks out.
This Month:
- Run a metered pilot cohort — 10 to 20 sellers, not the whole team. Instrument three numbers per skill invocation: input tokens, output tokens, and Salesforce API calls. You need a real cost-per-pipeline-review from your own data volumes, because nobody is going to publish one for you.
- Create a dedicated External Client App for the Claude plugin, scoped to
mcp_api, notapi. One ECA per MCP client. Set an IP range. Shorten the refresh token lifetime from the one-year default. - Activate Dispatch Read-Only first and leave write Dispatch off. Then run a permission audit on every profile in the pilot cohort — not what those users do, what they can do. Anyone in the pilot who can deploy Apex or create a named credential should not be in the pilot.
- Audit the Slack surfaces separately. Claude Tag uses a different identity model. Ask which integration user it runs as and what that user's permission set contains.
Before Renewal:
- Put a consumption cap and an overage rate in the Anthropic contract, and make model routing an explicit contractual term — the difference between Sonnet 5 and Opus 5 at your volume is the difference between a line item and a budget line. Ask Salesforce, in writing, what happens to headless consumption pricing at your next renewal, because "subject to change" is currently the whole policy.
The Bottom Line
We have watched this movie in a different theatre. The last time enterprise software moved from a UI you licensed to an interface you consumed, the vendor's economics stopped being a fixed cost you could forecast and started being a variable you had to operate. That was the whole argument in Salesforce's earlier flat-fee agentic pricing experiment, and it is the argument again now — except this time the variable belongs to a second vendor who is not in the room when you renew your CRM.
Claudeforce is not a bad deal. Sellers hate Lightning navigation, Claude is genuinely good at synthesis over messy records, and Salesforce is right that the metadata is the moat. But "you can't buy this on one piece of paper" is not a rollout detail. It is the product architecture, and it means the FY27 sales-tech budget you already approved is short by an amount nobody has yet quantified.
Switch it on for twenty sellers in September and measure it. Switch it on for the whole team before the Anthropic paper exists and you have not bought a productivity tool — you have bought an uncapped variable with a September start date.
Continue Reading
- Agentic AI Pricing: Don't Buy Consumption Without a Cap
- Salesforce Headless 360: The UI Becomes Optional
- Snowflake Agents Run as All Your Roles. Revoke From PUBLIC.
- AI Gateway vs API Management: No Managed Gateway Caps Your Spend
- Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
- Toyota Ships an Agent in 4 Days. One Review Covers 50.
- Salesforce AELA: The End of Per-Seat AI Pricing
