Gemini Enterprise and Salesforce: the per-user identity bridge

One sentence: the platform enforces the permissions, so we never reimplement them. Everything else in this course follows from it.

1. VideoThe platform enforces the permissionsSalesforce already knows what this user may read. A second copy of that logic will drift, and drift means a leak.Preview6 min
2. VideoWhat a tool call is, and what it must carry6 min
3. VideoThe architecture, drawn end to end6 min
4. ReadingWhere this fits against tiers one and two5 min
5. VideoWhy reimplementing permissions always drifts eventually6 min
6. VideoThe one sentence that decides every design choice in this course5 min

The worked example the rest of the course keeps returning to: a real agent, 21 tools, one identity per call.

1. VideoTalk to Salesforce: what 21 tools actually do6 min
2. VideoReads run without confirmation. Every write does not.6 min
3. VideoA sub-agent with search grounding for contact enrichment6 min
4. ReadingThe tool list, grouped by what each one is allowed to touch5 min
5. VideoWhy 21 tools and not one enormous one6 min
6. LabLab: sketch a tool list for your own use case14 min

The mechanism the bridge is built on. Enough OAuth to be dangerous, aimed at exactly the flow this architecture uses.

1. VideoConnected apps, scopes, and the consent screen6 min
2. VideoAuthorization code flow, in the shape this bridge actually uses6 min
3. VideoScopes: asking for exactly what a tool needs and no more6 min
4. VideoRefresh tokens against access tokens, and where each lives6 min
5. ReadingOAuth vocabulary this course assumes5 min
6. VideoOne authorisation binds to exactly one agent5 min
7. LabLab: register a connected app and complete one authorization14 min

An identity map is not a permission model. It only says who someone is. The platform still says what they may do.

1. VideoMapping an external identity to a Salesforce user6 min
2. VideoWhy the mapping table is not a permission model of its own6 min
3. VideoWhat happens when the mapping is missing or ambiguous6 min
4. ReadingA mapping schema that survives an audit5 min
5. VideoLocal development fallback, gated behind a flag never available in the cloud6 min
6. LabLab: map three external identities to three Salesforce users14 min

The injected key name varies. The code probes known shapes, then scans, then raises a plain-English error instead of guessing.

1. VideoThe injected key name varies, so the code has to look6 min
2. VideoProbing known shapes, then scanning, then giving up honestly6 min
3. VideoRaising a plain-English permission error instead of a stack trace6 min
4. VideoFailing closed, and the error the user actually sees6 min
5. ReadingWhat “fails closed” means, precisely, in this architecture5 min
6. LabLab: build the token resolver, probe then scan then raise14 min
7. VideoTesting the resolver against every shape you know, and one you invented5 min

The rule enforced in three separate agents, because the failure mode is the same every time: one person’s conversation running as another.

1. VideoNever source a token from application-scoped stateAn application-scoped key is shared by every user of the agent. A token stored there runs one user’s conversation as another.6 min
2. VideoAn application-scoped key is shared by every user of the agent6 min
3. VideoHow a token stored there runs one user’s conversation as another6 min
4. VideoThe rule enforced in three separate agents, and why it recurs6 min
5. ReadingWhere application-scoped state is fine, and where it is a leak5 min
6. LabLab: find the application-scoped token in a sample codebase14 min
7. VideoThe code review question that catches this every time5 min

A user’s inbox is only ever reached with that user’s own token, and calendar events are created as the calling user so they own them.

1. VideoNo domain-wide delegation, and what that costs you in convenience6 min
2. VideoA user’s inbox reached only with that user’s own token6 min
3. VideoCalendar events created as the calling user, so they own them6 min
4. ReadingThe alternative: what domain-wide delegation would have let a bug do5 min
5. LabLab: create a calendar event as the calling user, not the app14 min
6. VideoThe trade-off, stated honestly, for a non-technical sponsor5 min

Tools that cannot over-return, described so the model can pick correctly, and shaped so a wrong pick is harmless.

1. VideoDesigning a tool that cannot return more than the caller may see6 min
2. VideoTool descriptions, and the model choosing the wrong one6 min
3. VideoWrites: confirmation, validation and the audit record6 min
4. VideoField-level security enforced by the platform, not re-checked by the tool6 min
5. ReadingA tool contract: what it promises, and what it refuses to promise5 min
6. LabLab: expose three read tools and one write tool20 min
7. VideoWhy over-returning is a leak even when nobody asked for the extra field5 min

Refresh, revocation, deactivation and tracing. The half that decides whether this is still working in six months.

1. VideoToken refresh and revocation6 min
2. VideoWhat happens when a user is deactivated mid-conversation6 min
3. VideoRevoking access without breaking every other user’s session6 min
4. VideoMonitoring token failures as a leading indicator, not a support ticket6 min
5. ReadingA runbook for “the bridge stopped working for one person”5 min
6. LabLab: revoke a token and prove the next call fails closed14 min
7. VideoWhat changes when the external platform rotates its own credentials5 min

One correlation id, carried from the agent turn into the Apex log. Without it a cross-platform failure is unfalsifiable.

1. VideoTracing one request across two platformsOne correlation id, carried from the agent turn into the Apex log.6 min
2. VideoA cross-platform failure is unfalsifiable without a correlation id6 min
3. LabLab: trace a failing call to its cause20 min
4. VideoThe 21-tool agent, traced: one real request end to end6 min
5. ReadingWhat to log, and what never to log, on the way through5 min
6. VideoReviewing the whole bridge against the thesis one more time5 min
7. QuizCheck: the identity bridge24 min