In the constructed stack taken apart below (illustrative figures throughout), a Salesforce AI agent drafted metadata changes about as well as the team's humans did, and then deployed them straight to the org with nothing in between. The broken part is the direct write path: no durable diff the team owns before the change lands, and no structural stop between draft and production. A pull request path fixes that layer. It does not make the agent smarter.
The symptom, and the suspect that came first
The case is constructed: every number below is illustrative. A four-admin team runs a Salesforce AI agent with a deploy-capable integration user. On a Tuesday, reps report that Opportunity saves fail. A validation rule changed overnight, and nobody remembers approving it.
The first suspect was the model. Reasonable: a rule blocking valid saves looks like a hallucinated condition. One measurement suggests swapping models would not have helped.
The measurement that pointed away from the Salesforce AI agent
Take every change from a 14-day window and score it by hand. Illustrative figures: 30 changes drafted by the Salesforce AI agent, 25 written by humans.
- Agent drafts with a defect: 3 of 30, which is 10%.
- Human changes with a defect: 4 of 25, which is 16%.
- Agent defects that reached production: 3 of 3, which is 100%.
- Human defects that reached production: 1 of 4, which is 25%.
The escape rate, not the defect rate, was the difference. Human changes passed a review that caught 3 of 4 problems; agent changes passed nothing.
Caveats: constructed figures, one small window, correlation only.
Walking the stack one layer at a time
Layer one, the request: block close dates in the past. Layer two, the model: the rule matched the request but also fired on every edit to an existing opportunity whose close date had already passed, the same class of defect the humans made. Layer three, the agent runtime: it checked that the rule compiled. Layer four, the credential: the integration user could deploy to production. Layer five, the write path: agent workspace to org, one step. Layer six, the org: rule active.
Layer five turns a draft defect into a production defect.
The pattern is on vendor pages. Flosum's homepage headline reads "Agents are changing your org at machine scale. Are you in control?", according to the vendor's page, read 1 Oct 2026. On HighRev's development page, the copy says "Complete your Deployment to your target org with a single click", according to the vendor's page, read 1 Oct 2026. To be fair to HighRev, its homepage also says developers review generated components in an IDE-style interface, with check-only validations before deployment, according to the vendor's page, read 1 Oct 2026. The constructed stack has no such step, so it lacks the layer that caught 3 of 4 human defects.
The mechanism: a write path with no stop in it
Direct write fails for two compounding reasons. First, no durable record exists before the change lands: the diff sits in the agent's workspace log, not in a history the team owns and can revert. Second, the stop is a habit, not a structure. Review that depends on opening a panel can be skipped.
Machine-scale drafting compounds it. At an illustrative 10% defect rate, 60 changes a fortnight means 6 bad ones, and at a 100% escape rate all 6 ship.
Rebuilding the Salesforce AI agent stack around a pull request
The fix moves layer five. The Salesforce AI agent still drafts, but the change lands as a pull request in a repository the team owns, with sandbox testing and human approval before it reaches production.
That is the structure FlowSprite AI is built on. Any AI the team already uses drafts the metadata change. FlowSprite AI lands it as a GitHub pull request in the customer's private repo. Changes are tested in a sandbox before production, a human approves before deploy, and production is never touched automatically. Every tool call the customer's AI executes is audited. Pricing is public: EUR 99 a month for Professional (10 users, 6 connections) and EUR 199 a month for Enterprise (25 users, 20 connections, approval workflows with separation of duties). There is a 14-day free trial with no card. Limits, honestly: Flosum bundles DevOps, backup, archive, security and governance in one platform and shows no public price, only a 'Book a Meeting' route, according to its homepage, read 1 Oct 2026, and a team that wants that is better served there. HighRev pitches implementation partners, according to the vendor's page, read 1 Oct 2026, so a partner running full implementations may prefer it. The Salesforce DX MCP server is free and open source, according to its GitHub README, read 1 Oct 2026, a fit for teams that assemble their own tooling.
Rerun the constructed 14-day window afterwards. Expected shape, not a measured result: the 3 defective drafts now pass the same kind of review that caught 3 of 4 human defects. At that illustrative 75% catch rate, review alone stops about 2 of 3 (3 x 0.75 = 2.25), instead of 0 of 3. That figure leaves out anything sandbox testing catches.
What the fix does not address: a bad spec still produces a bad rule, and a reviewer who approves without reading turns the pull request back into a one-click deploy. Admins editing production by hand bypass it.
The alert that would have caught it earlier
One alert: daily, list every metadata deploy to production. For each one, look for a merged pull request that produced it. Any deploy with no matching merge pages the integration user's owner.
Record shape: deploy id, timestamp, user, components, matched PR or null. In the constructed case, a deploy by the integration user with no matching merged pull request is the signal; before the fix every agent deploy trips it, and it fires the first night, before a rep hits a failed save, and the team debugs the path a Salesforce AI agent used, not the model.