# Salesforce Headless 360: What It Is and How to Close the AI Governance Gaps

This presentation explains how Salesforce’s move toward headless access and MCP servers is changing Salesforce from a UI-driven CRM used mainly by people into a system that agents and AI models can query directly. The speaker argues that releases such as Headless 360, Agentforce, AI Force, native cloud access, Slack integrations, and Salesforce coworker-style experiences open Salesforce data to non-UI clients at scale, which matters because Salesforce holds years of valuable system-of-record data. That shift also changes how integrations, business rules, access, and execution flows work, since agents can make large volumes of unpredictable calls based on prompts and returned context. The central warning is that this creates governance gaps, especially around granular MCP tool permissions, agent-to-agent traffic visibility and control, AI cost and token monitoring, and protection of personal data for GDPR-sensitive use cases. The recommended response is an AI gateway, with Kong presented as a control center similar to an ESB, but focused on centralized policy enforcement rather than integration logic.