Governance & AI safety
Letting an AI draft Salesforce changes only works if a human is always the last word and every action is auditable. Here's how FlowSprite enforces that.
The three approval gates
Pull-request gate
Every AI-drafted change opens a PR. Nothing deploys until a configured approver merges it.
Sandbox gate
Merged PRs deploy to a sandbox first. Production is never touched on the default path.
Production gate
FlowSprite packages the validated change for you to apply from Salesforce Setup. Teams that want it can opt into one-click promote — off by default, enabled per connection. Either way, production is your call.
Permission boundaries
FlowSprite operates with a connected app permission set you control. You can scope it to allow only metadata changes — never data, never user management, never license assignments. Tighten or relax per environment.
Audit log
Every AI-drafted change is attributed in three places: the GitHub PR (with the prompt), the Git commit (signed by the FlowSprite app), and the deploy event. Three independent records, all queryable. Alongside them, FlowSprite logs each Salesforce record read your AI makes (the tool, the object, the rows returned and the outcome) and each batch of a bulk record write.
Enterprise / Agency: approval workflows and verified deploys
Enterprise / Agency adds a formal approval workflow with separation of duties — the person who requests a change can never be the one who approves it — and every transition is audit-logged. Post-deploy verification then queries the org and returns a structured verdict (all changes matched, some failed, nothing verifiable, or inconclusive), so you know the difference between "nothing there" and "we couldn't check."
AI hallucination handling
The agent does not edit metadata it can't parse. If a change request requires modifying a metadata type the agent isn't confident about, it stops and asks. The PR is opened with the gap noted, not silently filled with guesses.
Rollback is a redeploy of a prior tagged state from your repo — additive-only, with removed components surfaced for review rather than silently deleted. The underlying primitive is Git history.
See the audit trail in your repo
Connect a sandbox, ship one change, look at the PR + commit + deploy events.
Start free in 2 minutes