Salesforce released its Winter ‘27 Platform update. It added a Headless Experience Layer for single widget deployment across channels. MCP Risk Scores now flag and block high-risk third-party servers in Security Center. Agent Skills and Plugins provide a unified registry for agent capabilities. Setup with Agentforce Enhancements adds natural language for sandbox and org tasks. Headless Dev Environment Enhancements extend sandbox and testing tools to headless workflows. Agentic Developer Lifecycle adds governance and deployment controls for agent-generated code. Security Mesh added DigitSec and WithSecure connectors for unified threat detection. Global Consent Manager synchronizes consent signals in real time for compliance. Observability Center delivers near real-time agent session tracing and error detection. Platform Encryption now covers Archive and Backup with customer-managed keys. All features are generally available unless noted as beta.
What changed
Headless workflows required separate UI code for each channel. Third-party MCP servers had no centralized risk assessment. Agent-generated code lacked end-to-end governance. Sandbox management and performance testing required a Salesforce UI session. Consent signals were not synchronized in real time. Archived and backed-up data fell outside platform encryption coverage.
What it unlocks
Deploying a single agent workflow across Slack, Microsoft Teams, React, and Lightning Web Components. Automatically flagging and blocking high-risk third-party MCP servers. Governing agent-generated code with compliance and audit controls. Managing sandboxes, masking test data, and running performance tests without a UI. Synchronizing consent signals in real time for marketing and legal use cases. Encrypting archived and backed-up data with customer-managed keys.
What you need to act on it
- Winter ‘27 Salesforce Platform release
- Agentforce, Slack, Data 360, Claude, or ChatGPT deployment for Agent Skills and Plugins
- Security Center access for MCP Risk Scores
- Lifecycle Center access for Agentic Developer Lifecycle
- Privacy Center access for Global Consent Manager
- Platform Encryption license for Archive and Backup
Sources