Who Is Typing the Prompt?

When the interface disappears, nothing in a prompt confirms who typed it. Permissions decide what an account may do, not whether the right person is the one doing it.

On September 15, 2026, at Dreamforce, Salesforce announced AIforce and a clear message: AI replaces the UI. Salesforce said people no longer need to come to Salesforce to get work done. Workers can update records, trigger workflows, and ask questions from Slack, Claude, Lightning, or custom interfaces they compose by describing what they want. Most people never loved the screens. They wanted the answer, so the direction makes sense.

It also raises a security question worth answering before the rollout plans are written.

The screen was doing quiet security work

A traditional application slows people down, and that is a fair complaint. It is also, quietly, a control. Pulling a thousand customer records through layouts and list views takes time. A prompt does not. An agent that can read across hundreds of records at once will do it for whoever typed the sentence. One line in a chat window now carries the reach that used to take an afternoon.

That is the productivity gain. It is also a larger blast radius.

Permissions check the token, not the person

Salesforce has been careful here. It says every request runs on the user’s existing permissions and business rules, so the agent only sees what the person asking could see. Those are real protections. But notice what they assume. Permissions decide what an account is allowed to do. They do not decide whether the right person is the one using it.

After a login, the decision is packed into a token or a session cookie, and from then on systems check the token. So if a Slack session is hijacked, the agent inherits that session’s permissions faithfully. If a vendor quietly shares a login, the agent serves them too. If an automated program is running under a person’s credentials, the permission check still passes. Every control does its job, and the wrong entity still gets the data.

Every chat window is now a front door

AIforce lets anyone build their own interface. The way into your CRM is no longer one application with one login page. It is Slack, Claude, Lightning, and every custom surface your teams create. Each of those authenticated someone, once, at some point. Authentication proves possession, not presence. It does not prove the same person is at the keyboard five minutes later.

The most capable attackers have adapted. They do not need to defeat the login. They need to survive it. A disciplined operator inside a hijacked session asks ordinary questions, at ordinary hours, about records the real user would plausibly need. With an agent doing the reading, those ordinary questions now cover far more ground.

The same two questions apply, with no screen

Mimoto builds around two questions, answered continuously through the whole session, not once at login. Is this a real human, or an agent? And is it the right human?

The interface changed. Those questions did not. A person still types the prompt, and the way they type and move, how they use their apps, their device and connection, and the context of the session are all still there to measure. Mimoto uses advanced pattern matching and anomaly detection on that picture. It never captures what someone types. The content of the prompt is none of Mimoto’s business. Whether the right person wrote it is.

This is not a fringe view. CISA’s Zero Trust Maturity Model describes its most mature stage for identity as checking identity continuously, not only when access is first granted. The frameworks have made the call. What most environments lack is the capability to follow through, and agent interfaces make the gap wider.

The honest caveat

Parts of AIforce are still in beta, and no one yet knows how enterprises will deploy it at scale. This is not a crisis. It is a design moment.

What to do this quarter

1. Map the new front doors. List every surface that can now act on your CRM data, including the ones employees build for themselves.
2. Ask what happens after login. For each surface, find out what confirms the person behind a request once the session is open. If the answer is “the token,” you have found your gap.
3. Measure before you commit. Observe live sessions and see how often the person driving one is not the person who signed in. Let the number make the case.

The UI may be going away. The need to know who is actually there is not.