Security + Constraints: Permission Sets, Data Loss Prevention and Governor Limits | SF Vibe Lab S15

Guest instructor Kate Lessard, Lead Admin Evangelist at Salesforce, teaches Salesforce security and platform limits using an org she set up on purpose with plenty of problems to fix. Her three goals for the class: apply the principle of least privilege, build a proactive security plan instead of reacting to breaches, and understand how platform limits tie into security. She starts with Salesforce's "shared responsibility" model and its three buckets of security: foundational (Salesforce's job), configurables (yours) and enhanceables (paid add-ons like Shield and Data Mask). The first demo is Security Health Check. The org starts at 68%, and one click on clickjack protection moves it into the "good" range. She then walks through four security pillars. For identity and access, she covers MFA, IP restrictions and the three authentication factors, plus the new rules that make MFA mandatory for every user and require phishing-resistant MFA for privileged users. She also tells the story of a hospital user who paid a local student to do her data entry. For permissions, a student explains profiles vs. permission sets, and she makes the case for a permission-set-led model with permission set groups and muting. In the org, 100% of users are system administrators, and the user access summary shows a regional sales manager with Modify All on every object. She demotes him and uses the Active System Administrators report to keep watch. For data loss prevention, she tells the story of a salesperson who took the full client list on the way out and shows data sensitivity and compliance classification fields (PII, HIPAA, GDPR). The fourth pillar is environment integrity: treating sandboxes like production. The limits section pairs each security idea with a platform-limit parallel, from "least capacity" for integration users to blast radius and sharing recalculation, and points to the Apex governor limits page in the developer guide. The takeaways: security is a team sport, set custom Health Check baselines and email alerts, and move from reactive to proactive. The last half hour is an open Q&A with students and hosts Rodrigo Maliachi and Edgar Cambranes. Topics include users as the weakest link, the limits admins hit most (DML inside flow loops), onboarding permissions, Agentforce agent permissions, real data in sandboxes, migrating off hundreds of custom profiles, checking what an AI agent built, career advice for new admins, and why soft skills still matter in the AI era. Apex governor limits: https://developer.salesforce.com/docs.... Session 15 of 23 from SF Vibe Lab at Universidad Autónoma de Yucatán. Chapters 00:00 Welcome: Kate Lessard and the three goals for today 01:37 What does "security in Salesforce" mean to you? 05:04 Security as a shared responsibility 06:59 Three buckets: foundational, configurables, enhanceables 09:11 Demo: Security Health Check and a 68% score 13:07 Proactive security and the four pillars 14:38 Pillar 1: Identity and access 16:11 Story: unusual IP logins at a hospital 18:30 30% of breaches come from misconfigured access 19:11 The three authentication factors 21:04 MFA required for every user 22:32 Phishing-resistant MFA for privileged users 24:03 Pillar 2: Permissions 25:32 Profiles vs. permission sets: the permission-set-led model 28:30 Permission set groups and muting 29:31 Demo: 100% of users are system admins 32:14 Principle of least privilege and permission creep 33:47 Demo: demoting a user and checking the health score 35:12 The Active System Administrators report 36:21 Pillar 3: Data loss prevention 37:10 Story: a client list walks out the door 39:39 Demo: data sensitivity and compliance classification 42:33 Pillar 4: Environment integrity and sandboxes 45:48 Platform limits: who can vs. how much 48:22 Where to look up Apex governor limits 50:09 Takeaways: security is a team sport 51:37 Health Check custom baselines and email alerts 53:46 From reactive to proactive, plus a hands-on workshop 54:26 Q&A: you can't control your users 1:00:08 Q&A: the limits admins hit most often 1:01:40 Q&A: permissions for new team members 1:04:30 Keeping a whole dev team on one security pattern 1:05:32 Q&A: Agentforce agents and permissions 1:06:48 Q&A: protecting real data in sandboxes 1:09:10 Q&A: moving from custom profiles to permission sets 1:11:33 Q&A: security-checking what an AI agent built 1:13:24 Advice for students starting a Salesforce career 1:18:32 New challenges for newcomers in the AI era 1:20:52 Communication and soft skills