Governance & AI safety
Letting an AI draft Salesforce changes only works if a human is always the last word and every action is auditable. Here's how FlowSprite enforces that.
The three approval gates
Pull-request gate
Every AI-drafted change opens a PR. Nothing deploys until a configured approver merges it.
Sandbox gate
Merged PRs deploy to a sandbox first. Production is never touched on the default path.
Production gate
FlowSprite packages the validated change for you to apply from Salesforce Setup. Teams that want it can opt into one-click promote — off by default, enabled per connection. Either way, production is your call.
Permission boundaries
FlowSprite operates with a connected app permission set you control. You can scope it to allow only metadata changes — never data, never user management, never license assignments. Tighten or relax per environment.
Audit log
Every AI-drafted change is attributed in three places: the GitHub PR (with the prompt), the Git commit (signed by the FlowSprite app), and the deploy event. Three independent records, all queryable, all immutable.
AI hallucination handling
The agent does not edit metadata it can't parse. If a change request requires modifying a metadata type the agent isn't confident about, it stops and asks. The PR is opened with the gap noted, not silently filled with guesses.
Rollback is a redeploy of a prior tagged state from your repo — additive-only, with removed components surfaced for review rather than silently deleted. The underlying primitive is Git history.
See the audit trail in your repo
Connect a sandbox, ship one change, look at the PR + commit + deploy events.
Start free in 2 minutes