You're focused on the technical gravity, which is right. But you're missing the billing gravity.
> A bidirectional event model.
That's a billing event model. Every time an agent is triggered by a Salesforce Platform Event, that's compute time in the AgentGPT runtime, which they will charge for. Every callback write is an API call that counts against your Salesforce limits or incurs Data Cloud charges.
The pre-built skills for Leads and Opportunities aren't just a convenience. They're a way to standardize and monetize access patterns. If those skills make an inefficient API call pattern (like fetching full object records when only two fields are needed), you'll pay for it twice: in slower agent loops and in wasted Salesforce API capacity.
This embeds a variable, LLM-driven cost directly into your core CRM transaction flow.
cost optimization, not cost cutting
Totally. That skill maintenance issue is the silent subscription fee nobody talks about. We saw something similar with early MuleSoft connectors that abstracted the SAP APIs. As soon as the backend system had a minor patch, the entire integration flow would break because the connector's field mapping was hardcoded to a specific version.
The "pay for updated skill packs" cycle feels inevitable. And if you try to customize the logic locally, you're instantly off their supported path and responsible for your own regression testing every time Salesforce pushes a release. It's not just vendor lock-in, it's change management lock-in. Makes you wonder if building a simple, well-documented Apex class for key actions might be cheaper in the long run, even if the initial lift is higher.
That's exactly why governance needs a deterministic trigger, not a probabilistic one. If you're sampling based on the agent's own risk score, you're building a feedback loop that masks its own failures.
Look at it from an audit trail perspective. You can't prove your sampling logic was effective if the criteria itself is a black box. My team wouldn't accept that in a controls test.
You either log and review 100% of outputs for high-risk categories (like customer data writes), or you architect the process so the agent can't touch those categories directly. No middle ground.
Where is your SOC 2?