What Salesforce announced
Salesforce announced on August 25 that it is expanding Headless 360 across its platform. The release includes an open-beta Headless 360 MCP Server, a generally available Data 360 MCP Server, more than 100 generally available agent skills, a generally available Slackbot MCP client, and headless capabilities across its major clouds.
Salesforce says authorized agents in Agentforce, Claude, ChatGPT, Cursor, and other platforms can dynamically discover and invoke capabilities while inheriting existing identity, permissions, metadata, validation rules, workflows, governance, and business logic. The company also says the Data 360 server exposes nearly 200 APIs and can support operations such as semantic-model creation, transformations, identity-graph inspection, segmentation, and activation.
The integration unit is moving above the API
The important architectural change is not MCP connectivity by itself. Headless 360 packages business behavior—not merely endpoints—as discoverable capabilities. That can reduce duplicated policy and orchestration code when several agents need to use the same CRM, service, commerce, or data workflow.
For production teams, this creates a capability layer between model reasoning and systems of record. That layer needs a stable contract: a narrowly described purpose, typed inputs and outputs, explicit side effects, deterministic validation, and versioning. Without those properties, dynamic discovery can turn API sprawl into capability sprawl.
Inherited permissions are necessary, but not sufficient
Reusing Salesforce identity and governance is valuable because it avoids recreating access policy in prompts or per-agent integrations. However, permission to reach a capability does not establish that a particular invocation is safe. An agent can be correctly authenticated and still act on injected instructions, stale context, an ambiguous customer identity, or a duplicated request.
High-impact operations therefore need controls at execution time: least-privilege scopes, transaction and data-loss policies, approval thresholds, idempotency keys, rate and value limits, and audit records that connect the human delegation, agent identity, model decision, capability call, and resulting state change. Teams should also test revocation against cached sessions and work already in flight.
Ineeza’s view
Headless 360 is a meaningful production signal because enterprise platforms are beginning to expose governed business logic as reusable agent infrastructure. The durable pattern is capability reuse with policy inheritance; the operational risk is mistaking discoverability and authentication for action-level authorization. Teams should treat every discovered capability as a privileged execution boundary and design it accordingly.