AIエージェントは「導入」より「運用」が難しい──Salesforce講演が示す5つの壁と、2026年7月時点の設計論Based on a Salesforce talk, this article identifies five operational walls…

Deploying an AI agent has become the easy part. Keeping one running reliably in production, according to a Salesforce talk summarized in this piece, is where most teams struggle. The article reframes the common assumption that the hard work ends at rollout, arguing instead that sustained operation is the real test. For organizations moving from pilots to production, that distinction matters because it changes where they should invest engineering effort, budget, and governance attention.

The core of the argument is a set of five operational walls that teams tend to hit after an agent goes live. The first is reliability. Agents built on large language models are probabilistic by nature, so the same input can produce different outputs, and a workflow that succeeds in a demo may fail intermittently at scale. The piece frames reliability not as a single fix but as an ongoing discipline involving retries, fallbacks, guardrails, and clear definitions of what "correct" behavior means for a given task.

The second wall is access control and permission management. When an agent can call tools, query databases, or trigger actions on a user's behalf, it inherits the difficult question of what it is actually allowed to do. The article emphasizes scoping permissions tightly and ensuring the agent operates under appropriate identity and authorization boundaries rather than broad, standing access. This concern grows as agents chain multiple tools together, since each connected system expands the potential blast radius of a mistaken or manipulated action.

Observability is the third wall. Traditional application monitoring assumes deterministic paths, but agents make dynamic decisions about which tools to call and in what order. Teams therefore need tracing that captures the agent's reasoning steps, tool invocations, inputs, and outputs so failures can be diagnosed after the fact. Without this visibility, debugging becomes guesswork, and it becomes hard to distinguish a model problem from a data problem or an integration problem.

The remaining walls, as the summary indicates, extend this theme of long-term operation, likely covering areas such as cost and performance management and the challenge of change over time. Costs can be unpredictable because token usage scales with how much reasoning and how many tool calls an agent performs. Change management is equally demanding: models get updated, prompts drift, tools evolve, and behavior that was validated last quarter may need to be re-evaluated. The article's practical design guidance appears aimed at treating an agent as a living system that requires continuous evaluation rather than a one-time deployment.

This framing sits within a broader industry conversation often labeled LLMOps, which adapts the ideas of MLOps and DevOps to generative systems. The tags accompanying the piece point specifically to the Model Context Protocol, or MCP, an open standard introduced by Anthropic that gives agents a consistent way to connect to external tools and data sources through MCP servers. MCP is relevant here because standardized tool connections make the permission and observability challenges more tractable, but they also concentrate risk: a single misconfigured server can expose many downstream systems. Adjacent efforts, including agent frameworks and orchestration layers from major vendors, are converging on similar concerns about safety, auditability, and control.

Salesforce's own interest in this area is worth noting as context. The company has been positioning agent technology, including its Agentforce line, as a central part of its platform strategy, so guidance drawn from its talks reflects a vendor actively shipping these systems to enterprise customers. Readers should weigh that perspective accordingly, though the operational problems described are broadly recognized across the field and not unique to any one product.

For practitioners, the value of the article lies in its emphasis on prerequisites that are easy to underestimate. Establishing evaluation datasets, defining acceptable behavior, instrumenting traces, and enforcing least-privilege access are foundational rather than optional. The recommendations are presented as a snapshot as of mid-2026, which is a sensible hedge given how quickly tooling and best practices are changing. The underlying message is durable even if specific techniques evolve: the difficulty of AI agents is concentrated less in getting them started and more in the day-to-day work of running them safely, predictably, and affordably over time.