An ISV embeds Agentforce by shipping agent actions, subagents and prompt templates inside its managed package. To ship a whole agent, it adds an agent template built from those parts. Salesforce's packaging guide says "agents are distributed by ISVs as agent templates," and the customer creates the agent from your template in their own Agentforce-enabled org. The agent itself never ships.
For a SaaS company that already has a managed package, the real decision is how much of the agent you own. Shipping actions lets your product answer inside agents your customers build. Shipping a template gives them a ready agent, but it comes with a current tooling limit covered below. Appnigma builds native Salesforce apps for SaaS teams, and its marketplace apps projects cover the managed package, listing preparation and review support, with agent components scoped into the same project. If you're a Salesforce customer looking for an implementation partner instead, the AgentExchange consulting listings are the place to start.
Updated October 2026. Checked against Salesforce's 2GP and 1GP packaging guides, the Agentforce developer guide and the ISVforce security requirements. The earlier version said Agentforce metadata works only in 2GP and dated the ISV announcement to June 2026. Both were wrong, and this update also adds the Agent Script limit, what customers see after install, and the review rules for actions and prompts.
What ships in a managed package, and in which package type
| Component | Metadata type | Managed 2GP | Managed 1GP |
|---|---|---|---|
| Agent action | GenAiFunction | Yes | Yes, after Salesforce provisions your packaging org |
| Subagent (formerly topic) | GenAiPlugin | Yes | Yes, after provisioning |
| Prompt template | GenAiPromptTemplate | Yes | Yes, after provisioning |
| Agent template | BotTemplate plus GenAiPlannerBundle | Yes, the documented workflow | Docs differ, so plan on 2GP |
| MCP server registration | ExternalCredential, ExternalServiceRegistration, NamedCredential, PermissionSet | Yes | Yes |
| The agent (Bot, BotVersion) | Bot, BotVersion | No | No |
Salesforce's Agentforce packaging page lists actions, topics and prompt templates as "Managed 2GP and Managed 1GP." A 1GP packaging org needs one extra step. You "must log a case with Salesforce Partner Support" to get Agentforce Extensibility for ISVs, and "Only 1GP development orgs created from Environment Hub can have Agentforce provisioned," per the 1GP access page.
Agent templates are the one place the docs disagree. The overview table lists them for both package types, but the packageable components list shows GenAiPlannerBundle for 2GP only, and the agent generate template command is described for "a second-generation managed package." So a 1GP ISV can add actions and prompt templates today without migrating. Moving to 2GP becomes worth it when you want to ship a full template, and Salesforce already recommends "managed 2GPs to create new apps" in its managed packaging overview. Our guide to moving a 1GP package to 2GP covers that move.
Every action or topic you package has to live in the Agentforce Asset Library first. Salesforce says "Any agent action or topic that will be packaged must be in the Agentforce Asset Library," and local copies get swapped for their global equivalents when the template is generated.
Actions only, or a full agent template?
Most SaaS products should start with actions. An action is a callable unit of logic, such as an invocable Apex method, an autolaunched flow or a prompt template, that an agent decides to run. If your product scores deals or summarizes calls, shipping that as an action means it shows up wherever the customer's admin adds it to an agent, including agents they built themselves. Salesforce's AgentExchange install guide describes it from the admin's side. "Install an app to add its assets to your org, then add them to an agent in Agentforce Builder."
A template makes sense when the value is the whole conversation design, meaning the instructions, the subagents and the order actions run in. A support product that ships a complete triage agent is a fair fit. The cost is maintenance. You're now responsible for agent behavior inside hundreds of orgs with different data, and every change ships as a package version.
The third option is an MCP server registration. If your product already exposes an MCP server, Salesforce lets you package the registration "either as a component of an Agentforce extension package or as a standalone managed package," per its MCP packaging page. Two pieces don't travel yet. "These components aren't packageable at this time," the page says of MCP tool actions and Agentforce Gateway policies, so the customer's admin creates those after install.
Can you package an agent built with Agent Script?
Not as a template, for now. Agent Script is "the language for building agents in Agentforce Builder," per Salesforce's Agent Script guide, and the packaging guide says "You can't create packageable agent templates from agents that use Agent Script as their blueprint." Salesforce's Agentforce DX troubleshooting page calls this "a known limitation" and suggests checking the DX release notes for updates. No date has been announced.
This matters more than it looks. From API version 68, Salesforce's Agentforce metadata reference says Bot and BotVersion are "Used only by Einstein Bots, not by Agentforce agents," and GenAiPlannerBundle "Doesn't exist in v68 and later releases." The template path is built on the earlier agent model. If your team builds the reference agent in the current Agentforce Builder, check its blueprint before planning a template release. Actions, subagents and prompt templates package the same way either way, which is one more reason to lead with them.
One naming note helps when reading older docs. "Beginning in April 2026, agent topics are now called subagents. There are no changes to functionality." The metadata type is still GenAiPlugin.
From scratch org to package version
Salesforce documents the template path through a Partner Business Org with Dev Hub enabled, a namespace linked from that org, and a namespaced scratch org with Agentforce turned on. The scratch org definition needs the Einstein1AIPlatform feature, per the Agentforce scratch org guide. To package BotTemplate metadata, "you must first enable Einstein Chatbot in your Dev Hub org."
After you build and test the agent in that scratch org, the agent template workflow is four commands.
sf project retrieve start --metadata Agent:Deal_Risk_Agent --target-org MyNamespacedScratchOrg
sf agent generate template --agent-file force-app/main/default/bots/Deal_Risk_Agent/Deal_Risk_Agent.bot-meta.xml --agent-version 1 --source-org MyNamespacedScratchOrg
sf project deploy start --source-dir force-app --target-org MyNamespacedScratchOrg
sf package version create --package "Deal Risk" --definition-file config/project-scratch-def.json --code-coverage --wait 10Between the deploy and the package version, test the template by creating a new agent from it in the scratch org. Then delete three files from your package directory. Remove the original GenAiPlannerBundle (the one without "Template" in its name), plus the Bot and BotVersion, "since agents aren't packageable." Leaving them in causes packaging errors.
Two prerequisites catch teams late. Prompt templates need permissions assigned in sfdx-project.json before they'll package. Prompt templates that use RAG, retrievers or a bring-your-own model need a scratch org with Data Cloud as well, and Salesforce grants that permission "only to PBO orgs" after you open a case.
What your customer gets after install
The customer installs your package into an Agentforce-enabled org. Salesforce says "they can use the Agentforce UI to create an agent from your template," so each customer ends up with their own agent, which they can rename and adjust. Your package doesn't turn Agentforce on for them. Confirm their edition and Agentforce licensing with Salesforce before you promise a go-live date, because the packaging docs don't spell out the subscriber requirements.
Prompt templates behave differently from most packaged metadata. Salesforce's prompt template packaging considerations say "Customers can't edit packaged templates directly." They can always clone one, and the clone stops receiving your upgrades. You can also mark a template overridable, and "If a subscriber activates an override version, that version takes precedence over the publisher's active version." Decide per template. One that formats your product's data probably shouldn't be overridable, while one that sets the tone of a customer email probably should.
Two more prompt template rules affect upgrades. "Any future changes to a published version are skipped during upgrade without error," so ship wording changes as a new version. Data Search and Data Graph retrievers "aren't included in packages," so a grounded template needs its retriever delivered to the customer separately.
Upgrades follow normal package rules. The components list marks actions, topics, prompt templates and planner bundles as updated during package upgrade, and the subscriber can't delete them. The subscriber can delete a BotTemplate. Removing any component from a released package "requires approval from Salesforce," so name and scope actions carefully in version one.
What security review checks on agent actions and prompts
Salesforce's Agentforce security requirements apply to "All Agentforce solutions listed on AgentExchange," on top of the standard security review. The rules for custom actions start with documentation. "In your managed package documentation, classify all custom actions." Each one is marked as intended for employee-facing or service agents, and as public or private.
The identity question is where reviewers focus. When an employee-facing agent runs an action, it runs as the user who asked. When a service agent runs it, "the identity of the agent is used to execute the action," so a private action exposed to customers must "Require a verified customer identity" and scope every query to it. Every action needs CRUD, field-level security and sharing checks. Actions that accept "generic record references, record IDs, object names, or field names as user-controlled input aren't allowed."
Prompts have their own list. They can't ask users for authentication tokens, and they have to be stored in prompt templates, protected custom settings or protected custom metadata. They also need prompt injection defenses such as hardened instructions and input validation. Salesforce's random sequence enclosure guidance says to "Use a new random token sequence for each prompt inference operation." Our security review checklist covers the rest of the review.
Mistakes that stall an Agentforce package
- Building the reference agent with Agent Script, then finding the template command won't run against it.
- Leaving Bot, BotVersion or the original planner bundle in the package directory.
- Packaging an action that takes a record ID or object name as free user input.
- Editing a published prompt template version and expecting the upgrade to carry it.
- Shipping a template with wording customers must change without marking it overridable.
- Hard-coding prompts in Apex when a prompt template or protected custom metadata would work.
- Skipping the action classification in your docs, which reviewers check first.
Selling the agent on AgentExchange
Salesforce announced that Agentforce for ISVs is GA in October 2025, then widened it in December 2025. The December announcement says "ISVs can now embed the full Agentforce 360 as the foundation for their agentic applications," with "seat-based, usage-based, or consumption pricing through Flex Credits." The marketplace is now one store. Salesforce's AgentExchange overview says "We've unified AppExchange, AgentExchange, and Slack Marketplace into a single destination." Our explainer on what AgentExchange is covers the change.
A listing with agent features carries extra fields. Salesforce asks for an Agentforce capabilities description "in 100 characters or fewer" plus the number of agents, topics and actions, per its AI details guide. Write that line around the job your action does, since it's what an admin reads while choosing what to add to an agent.
For transactions, the Go-To-Market app requires "a seat-based managed package," is "available to US-based customers only," and only works with customers "new to the partner." Our guide to private offers through the Go-to-Market App walks through it. The one revenue share Salesforce publishes is for AgentExchange Checkout, where "If the customer pays with a bank transfer, the revenue share is 15%." Other rates are set in your partner agreement.
Frequently Asked Questions
Can you package Agentforce components in a 1GP managed package?
Yes for actions, subagents and prompt templates, after Salesforce Partner Support provisions an Environment Hub packaging org. Agent templates follow a 2GP workflow.
What is the difference between an agent template and an agent action?
An action is one task an agent can run, and it can be added to any agent the customer builds. An agent template is a full agent design that the customer turns into their own agent after install.
Can I package an agent built with Agent Script?
Not as an agent template today. Salesforce lists it as a known limitation, so ship the actions and prompt templates, which package normally.
Can customers edit a packaged prompt template?
Not directly. They can clone it, and they can activate an override version only if you marked the template overridable.
Can Appnigma build our Agentforce components?
Yes. Appnigma's marketplace apps projects deliver native Salesforce apps with listing preparation and review support, and agent actions, prompt templates and templates can be scoped into the same build. Salesforce decides review outcomes.
About the author
Sunny Chauhan is the co-founder and CEO of Appnigma AI, which builds and maintains customer integrations and native Salesforce and HubSpot apps for B2B SaaS teams. Before Appnigma, he was on Salesforce's AppExchange team, where he worked with more than 300 SaaS partners. He has spent close to a decade on the Salesforce platform, including work at Zennify, and holds Salesforce certifications including Platform Developer II, Platform App Builder, Administrator, Data Cloud Consultant, and AI Associate.
Related Articles
- How to build Agentforce actions, topics and prompt templates
- Moving a 1GP package to 2GP
- AppExchange security review checklist
- What AgentExchange is
- Joining the Salesforce ISV partner program
Sources
- Package Agentforce metadata components, Second-Generation Managed Packaging Developer Guide
- Develop and package agent templates using scratch orgs, Salesforce Developers
- Get access to Agentforce in your 1GP packaging org, First-Generation Managed Packaging Developer Guide
- Components available in 2GP, Salesforce Developers
- agent generate template, Salesforce CLI Command Reference
- Get access to scratch orgs that have Agentforce, Salesforce Developers
- MCP for Agentforce metadata in managed packages, Salesforce Developers
- Get started with Agent Script and Troubleshoot Agentforce DX issues, Agentforce Developer Guide
- Agentforce metadata types (v68 and later), Salesforce Developers
- Secure your Agentforce solution, custom actions and prompts, ISVforce Guide
- Agentforce for ISVs is GA, Salesforce blog (October 2025)
- Salesforce opens Agentforce 360 to builders, Salesforce Newsroom (December 2025)
- What is AgentExchange?, AgentExchange Installation Guide
- Go-To-Market app prerequisites and AgentExchange Checkout revenue share, ISVforce Guide
- Packaging considerations for prompt templates, Salesforce Help
