Salesforce Architecture with Headless 360: An Enterprise Reference Architecture for API-, MCP-, and Agent-Ready Customer Platforms

Abstract

Salesforce Headless 360 represents a shift from interface-centric enterprise application design toward capability-centric architecture. Instead of treating Salesforce primarily as a browser application, a headless approach exposes trusted data, business logic, workflows, identity, authorization, and operational capabilities to external applications, AI agents, and user experiences through APIs, Model Context Protocol (MCP) tools, skills, command-line interfaces, and headless experience layers. Salesforce describes Headless 360 as a broad architectural transformation rather than a single product or SKU, with the browser becoming optional while existing governance and business logic remain central. [1], [2]
This article proposes a reference architecture for applying Headless 360 principles to enterprise Salesforce environments. The architecture separates the system of record, trusted data, integration services, agent/tool access, experience channels, and governance controls while preserving Salesforce as the authoritative business platform. It introduces design principles for security, idempotency, deterministic business services, observability, data minimization, API lifecycle management, and human approval. Particular attention is given to the implications of non-deterministic agent callers: unlike traditional applications that execute a predefined sequence, an AI agent may choose tools dynamically and retry actions. Salesforce guidance therefore emphasizes preserving existing integration patterns while adding safeguards such as idempotent actions and stronger authorization controls. [10]
The proposed architecture is intended to help organizations modernize Customer 360 without replacing core Salesforce investments. It also provides a practical framework for evaluating where to use APIs, MCP, headless experiences, Data 360, MuleSoft, and Agentforce. The article identifies an evaluation model spanning security, business continuity, integration correctness, observability, and user experience. The paper is architectural and design-oriented; it does not claim empirical performance superiority without benchmark evidence.