{
  "id": "salesforce-agentforce-stdm-observer-skill",
  "name": "Salesforce Agentforce STDM Observer Skill",
  "type": "skill",
  "provider": "salesforce",
  "harnesses": ["claude-code", "codex", "cursor", "gemini", "kiro", "other"],
  "summary": "Queries Salesforce Telemetry and Data Management (STDM) and Data Cloud for live Agentforce session traces, faithfulness scores, answer relevance scores, action invocation telemetry, and quality metrics under T1 least-privilege scope. Answers the Fortune 50 CISO question: is the Agentforce agent working correctly in production? Emits aggregate metrics only — never session content.",
  "source_type": "adapted",
  "source_attribution": "Adapted from the observing-agentforce skill published by Salesforce in the forcedotcom/sf-skills repository (Apache-2.0). Vanguard-specific additions: T1 least-privilege contract, structured audit envelope, aggregate-only output policy, and handoff routing model.",
  "execution_tier": "read-only-runtime",
  "oauth_scopes": ["api", "refresh_token", "cdp_query_api"],
  "run_as_permissions": {
    "required": ["View Setup and Configuration", "Data Cloud Query API access"],
    "denied": [
      "ModifyAllData",
      "ViewAllData",
      "ViewEncryptedData",
      "ModifyMetadata",
      "AuthorApex",
      "ManageConnectedApps",
      "Customize Application",
      "Manage Agentforce"
    ]
  },
  "official_docs": [
    "https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_aiagenttagassociation.htm",
    "https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_aiagenttagdefinition.htm",
    "https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_aievaluationdefinition.htm",
    "https://developer.salesforce.com/docs/atlas.en-us.dataapiref.meta/dataapiref/data_api_query.htm",
    "https://help.salesforce.com/s/articleView?id=sf.data_cloud_admin_setup.htm",
    "https://help.salesforce.com/s/articleView?id=sf.agentforce_manage_agents.htm",
    "https://developer.salesforce.com/docs/einstein/genai/guide/agentforce-overview.html"
  ],
  "security_notes": "T1 read-only runtime. Aggregate-only output — session text content (user messages, agent responses, LLM prompts) is never emitted under any circumstance. All Salesforce record IDs are replaced with placeholders; record IDs in action invocations are hashed. User IDs and session participant IDs are replaced with placeholders. The cdp_query_api OAuth scope grants read-only Data Cloud query access only — no write access to Data Cloud. The Run As service account must have Manage Agentforce permission explicitly denied. Structured audit envelope emitted on every execution. Regulated-vertical orgs trigger mandatory escalation to salesforce-compliance-privacy-agent.",
  "last_verified": "2026-05-21",
  "path": "skills/salesforce/salesforce-agentforce-stdm-observer-skill",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0",
  "companion_skills": ["salesforce-agentforce-risk-review-skill"],
  "verify_before_merge": "All Agentforce, STDM, Data Cloud, and Einstein AI feature names, DMO field names, object names, and API structures evolve rapidly. Validate all references against current official Salesforce documentation before production use. AiAgentTagAssociation, AiEvaluationDefinition, GenAiPlannerDefinition, and STDM DMO names are particularly prone to changes across releases."
}