Key Takeaways
Dreamforce may be behind us, but the innovations announced at the event are just beginning to roll out. For the Salesforce Platform, the Winter ‘27 release has a little bit of everything. From automating DevOps with the Agentic Developer Lifecycle to blocking third-party threats with MCP Risk Scores and deploying universal UI with the Headless Experience Layer, this release is designed to help you build, secure, and scale your org faster than ever.
We’ve rounded up the most impactful dev and security features for the Winter ‘27 release so you can start exploring them today. All features are generally available (GA) unless otherwise noted.
Developer Services
Headless Experience Layer
Developers building Agentforce experiences no longer need separate UI code for every channel. Headless Experience Layer Enhancements let a single widget definition render natively across Slack, Microsoft Teams, React, and Lightning Web Components, powered by the agentic-api-service translation layer. Included in the platform license, the capability removes a longstanding cost and effort barrier to deploying rich, interactive agent experiences across every surface customers use.
Agent Skills and Plugins
Enterprises deploying agents across Agentforce, Slack, Data 360, Claude, and ChatGPT have lacked a single, governed way to discover and reuse skills. Agent Skills and Plugins introduces a unified registry with an automated verification pipeline that checks naming, accuracy, and outcome quality before any skill reaches production. Developers build reusable capabilities once; agents execute them consistently and securely across every surface an enterprise runs.
Setup with Agentforce Enhancements
Salesforce Setup spans more than 1,000 pages, requiring admins to navigate deep menus for routine, multi-step tasks. Setup with Agentforce Enhancements adds natural language capabilities for sandbox management, package deployment, feature enablement, and org health, powered by the Atlas Reasoning Engine. Admins complete tasks through a single conversation in Setup instead of manually hunting across hundreds of pages, cutting configuration time and errors.
Headless Developer Environment Enhancements
Developers building headless Agentforce applications have had to leave their toolchain to manage sandboxes, mask test data, or run performance tests. Headless Dev Environment Enhancements extend sandbox lifecycle management, Data Mask & Seed, and scale testing to headless surfaces, so developers provision environments and validate performance without a Salesforce UI session. The result is a complete, agent-native development environment built for headless workflows.
Agentic Developer Lifecycle
Coding agents now generate code faster than manual release processes can govern or deploy it, creating compliance risk for enterprises. Coding Agent Governance and Deployment adds policy enforcement, approval workflows, and audit logging to Lifecycle Center (formerly DevOps Center), alongside lifecycle automation that carries agent-generated code from planning through testing and deployment. Enterprises move at agent speed while meeting the compliance and audit standards their release processes require.
Salesforce Guardian
MCP Risk Scores in Security Center
Third-party MCP servers expose agentic deployments to tool poisoning and rug pull attacks — yet most organizations have no centralized way to assess server safety before or after connection. Security Center now surfaces a Low, Medium, or High risk score for every third-party MCP server, scanned at registration and continuously monitored for change. Admins get one place to see risk, set policies, and block high-risk servers — without manual investigation.
Security Mesh — New Connectors
Disconnected security tools create vendor sprawl, making it difficult to maintain a centralized view of an organization’s risk. Security Mesh in Security Center now adds DigitSec and WithSecure connectors, unifying code scanning, pipeline security, and file threat detection into a single standardized format. Now, your teams can query, analyze, and act on signals that used to get lost in the noise.
Global Consent Manager
Organizations processing consent at enterprise scale can now govern opt-in and opt-out signals in real time for both marketing and legal use cases. Global Consent Manager in Privacy Center uses an event-driven architecture to synchronize consent signals and generate verified audit trails, giving organizations a single, always-audit-ready system of record for consent that supports compliance with GDPR, CCPA, and other global privacy frameworks.
Observability Center (Beta)
Enterprise agentic deployments have long operated as an untraceable black box. Admins had no way to see what external agents connected via MCP or direct APIs were doing, catch errors, or pinpoint performance degradation. Observability Center delivers near real-time session tracing, error detection, and performance monitoring across every agent interaction in a single unified console, powered by Headless Toolkit tracing. Organizations can now troubleshoot agentic deployments without engineering escalation — and deploy with confidence.
Platform Encryption for Archive and Backup
Regulated organizations in financial services, healthcare, and the public sector face persistent compliance gaps when archived records and backed-up data fall outside Shield: Platform Encryption coverage. Platform Encryption for Archive and Backup extends native BYOK and customer-managed encryption keys to Salesforce Archive and Backup & Recover — all within the Trust Layer, with no third-party key management tools required. Security auditors gain verified, end-to-end proof of encryption across every stage of the data lifecycle.
Learn more:
- Discover what else is new on the Winter ‘27 release page
- Take the Winter ’27 Release module on Trailhead
- Read the Winter ’27 Release Notes
Start your trial
Try the Salesforce Platform for 30 days. No credit card, no installations.
