Salesforce Koa Model Challenges Frontier AI With CRM Reasoning and Agent Controls

Salesforce introduced its first CRM reasoning model at Dreamforce, challenging the assumption that enterprise agents should always depend on frontier AI providers. The Salesforce Koa model is built on NVIDIA Nemotron and tuned for multistep sales, service, and marketing workflows.

The model arrived alongside broader controls for governing agents, models, data access, and costs. Together, those announcements reveal Salesforce’s larger bet. The company wants enterprise context and operational control to matter more than having the smartest general-purpose model.

That position places Salesforce between two competing approaches. OpenAI and Anthropic offer broad intelligence through proprietary frontier models. Salesforce argues that specialized reasoning, business context, and enforceable permissions can produce more useful enterprise agents.

Koa does not settle that argument. Salesforce’s own research says the model remains behind the strongest frontier systems on several evaluations. Availability details for parts of its wider control architecture also extend into Salesforce’s fiscal 2028.

The announcements are still important because Salesforce is no longer treating models as interchangeable infrastructure supplied entirely by outside labs. It now owns a reasoning model, its post-training process, the surrounding business context, and the controls governing how agents act.

The Salesforce Koa Model Targets CRM Work, Not Every Possible Question

Koa narrows the model’s job to enterprise workflows where accurate tool use matters more than open-ended conversation.

Salesforce and NVIDIA announced Koa in San Francisco on September 15 during Dreamforce 2026. Salesforce describes it as its first reasoning model specifically designed for customer relationship management work inside Agentforce.

A reasoning model spends additional computation planning or evaluating steps before producing an answer or action. In Koa’s case, that process focuses on workflows involving business records, policies, and software tools.

Examples include qualifying a sales opportunity, routing a support case, scheduling a follow-up, or deciding which action should happen next. These tasks sound ordinary, but they require more than generating fluent text.

An agent must select the correct tool, supply valid arguments, observe the result, and continue without violating the organization’s rules. A single wrong action can change a customer record or expose restricted information.

According to the Koa announcement, Salesforce created the model by post-training NVIDIA’s Nemotron 3 Super. The foundation model has 120 billion parameters and uses a mixture-of-experts architecture, which activates only part of the network for each token.

Salesforce says it trained Koa with public information and synthetic interactions rather than customer data. Those synthetic scenarios imitate CRM situations, including sales conversations, service cases, changing customer behavior, and multistep tool calls.

The distinction matters for enterprise buyers. Training on real customer records could create privacy, consent, retention, and intellectual property concerns. Synthetic training lets Salesforce reproduce workflow patterns without placing actual customer data inside the model’s weights.

Koa also runs within Salesforce’s trust boundary. Salesforce controls its model weights, post-training, and inference, reducing the number of external systems involved when Agentforce processes sensitive business information.

That does not make Koa an open model for customers to download and run anywhere. It is better understood as a Salesforce-hosted model derived from an open-weight NVIDIA foundation.

Agentforce customers can still use other models. Koa becomes another option within Salesforce’s model-routing system rather than a mandatory replacement for OpenAI, Anthropic, or Google models.

This choice-based approach protects Salesforce from betting everything on one model provider. It also gives the company a model it can optimize around its own APIs, Agent Script specifications, and CRM workflows.

The immediate change is therefore larger than one model release. Salesforce has moved from orchestrating external intelligence to developing a specialized reasoning layer that it can tune and operate itself.

Why Salesforce Built Its Own CRM Reasoning Model Now

Salesforce needs to show that its customer data, workflow definitions, and permissions create an advantage that general-purpose AI platforms cannot easily reproduce.

Agentforce previously relied on external frontier models for demanding reasoning tasks. Salesforce had produced smaller task-specific models, but long-running workflows often required Claude, ChatGPT, or another outside system.

Koa changes that dependency. Jayesh Govindarajan, Salesforce’s executive vice president of AI, told TechCrunch that the company had relied on frontier providers for reasoning “until now.”

That timing reflects a strategic threat. Frontier AI companies are adding tools, memory, integrations, and enterprise connectors around their models. Their agents can increasingly interact with sales, support, legal, and analytics systems without requiring users to remain inside a conventional Salesforce interface.

Salesforce’s answer is not to compete for the most capable general chatbot. It is to make its accumulated understanding of enterprise work usable as model training material and runtime context.

The company says Koa’s synthetic dataset reflects nearly three decades of CRM deployments. This does not mean the model contains 27 years of customer records. Salesforce says it modeled enterprise workflows and operational patterns without training on customer data.

That distinction should remain clear. Koa’s advantage depends on whether synthetic scenarios accurately represent the messy situations that agents encounter in real organizations.

A sales process rarely follows one clean sequence. Permissions differ by role, fields may be incomplete, regional policies conflict, and human approvals can interrupt an automated workflow.

Salesforce’s Agent Script provides part of the answer. It is a declarative language that defines an agent’s routing, subagents, available actions, tool scope, workflow instructions, and termination conditions.

The company’s researchers used those specifications to generate simulated environments and training tasks. Koa then received rewards for resolving requests through successful tool use, not simply for producing plausible text.

This mechanism creates a direct connection between agent configuration and model post-training. The same workflow specification that controls a deployed agent can help generate scenarios for improving the underlying model.

For Salesforce, that connection forms a potential feedback loop. More detailed agent specifications can produce better simulations, while a better model can execute those specifications more reliably.

It also supports Salesforce’s broader argument that enterprise context becomes more valuable as foundation models become more widely available. Models can change, but an organization’s customer history, policies, business definitions, permissions, and workflows remain specific to that organization.

Salesforce formalized that idea through its Enterprise AI Harness. The architecture combines context, agency, actions, governance, security, and model choice under a common control layer.

This is where Koa and the security announcements connect. A specialized model alone cannot safely operate an enterprise system. It needs verified context, limited tools, authenticated identities, observable behavior, and policies that remain enforceable when the model makes a mistake.

Knowledge workers face a similar context problem on a smaller scale. Useful AI depends on connecting reliable source material through knowledge blending, rather than asking a model to reconstruct every detail from general training.

Salesforce is applying that principle across corporate systems. Its strategic asset is not only the model. It is the governed context surrounding every decision and action.

Koa’s Results Challenge General Models Without Beating the Best

Salesforce’s published results support specialization, but they do not show that Koa consistently outperforms leading frontier models.

The Salesforce Koa model is accompanied by a technical paper, giving buyers more evidence than a keynote demonstration alone. The paper explains the training process, benchmark design, and several important limitations.

Salesforce researchers evaluated Koa on Tau2Bench, the Berkeley Function Calling Leaderboard, and a CRM benchmark. These tests cover conversational tool use, function calling, and enterprise CRM tasks.

On Tau2Bench, Koa received a task-weighted score of 69.41. Its Nemotron base scored 68.64, while GPT-4.1 scored 54.48.

Koa recorded 66.63 percent on the Berkeley function-calling evaluation. The Nemotron base reached 64.73 percent, while GPT-4.1 reached 53.96 percent.

The CRM benchmark produced a more modest difference. Koa scored 0.86 overall, compared with 0.84 for Nemotron and 0.81 for GPT-4.1.

Koa’s function-call accuracy on that CRM evaluation reached 0.77, up from the base model’s 0.71. That result is relevant because choosing a correct tool is central to reliable agent behavior.

However, the strongest frontier models still led important comparisons. OpenAI’s GPT-5.5 scored 83.99 on Tau2Bench and 0.90 overall on the CRM benchmark. Claude Opus 4.8 scored 78.18 on the function-calling test and 0.87 on CRM.

The Koa research paper explicitly states that Koa remains below the strongest frontier models. That disclosure prevents a broader interpretation that Salesforce has overtaken the leading AI labs.

Instead, the results support a narrower conclusion. Post-training an open-weight base around workflow specifications improved several tool-use measurements and outperformed an older proprietary baseline.

Salesforce also says Koa produced three times fewer errors on its own CRM benchmark. Buyers should treat that figure as a company-reported result, especially because benchmark composition can strongly influence outcomes.

A model trained around Agent Script workflows has an expected advantage on evaluations resembling those workflows. That does not invalidate the result, but it limits how widely the finding should be generalized.

The paper identifies another constraint. Nemotron had already undergone reinforcement learning before Salesforce began its comparison of further reinforcement learning and supervised fine-tuning.

The researchers found reinforcement learning more useful for multistep tool use from that starting point. They caution that the same outcome might not apply to a foundation model that had received no prior reinforcement learning.

Real deployments will create harder tests than controlled benchmarks. Customer data can be incomplete, APIs can fail, tools can change, and requests can move beyond the scenarios represented during training.

Security failures also differ from ordinary reasoning errors. A slightly incorrect summary may be inconvenient. An incorrect permission decision or unauthorized tool call can become a reportable incident.

That gap explains why Salesforce paired Koa with agent controls. Better reasoning lowers one category of failure, but enterprise deployment requires systems that limit the consequences when reasoning still goes wrong.

Agent Security Becomes the Other Half of Salesforce’s Bet

Salesforce is treating agent security as a runtime control problem, not a promise that a sufficiently accurate model will always behave correctly.

Traditional software executes defined instructions. AI agents interpret goals, select tools, and adapt their plans while operating. That flexibility creates a larger and less predictable attack surface.

An agent can retrieve malicious instructions from a document, expose data through an approved connector, select an overly broad tool, or continue acting after its original context becomes unreliable.

Model improvements cannot remove those risks on their own. Security controls need to govern identity, permissions, data access, actions, and behavior outside the model.

Salesforce Guardian is the company’s security, compliance, privacy, and resilience portfolio for that environment. Existing capabilities include Shield, security monitoring, backup, recovery, sandbox testing, and controls around sensitive data.

Salesforce says Shield can monitor agent reasoning and block unauthorized data access. Its broader Guardian portfolio is intended to help administrators observe agent behavior, enforce access policies, preserve records, and recover from unwanted changes.

At Dreamforce, Salesforce placed these controls within a larger architecture rather than presenting them as isolated add-ons. The Enterprise AI Harness includes a Trusted Security capability covering identity, permissions, privacy, data protection, and runtime security.

The company also announced an AI Control Plane. Salesforce says this interface will let organizations discover agents, register capabilities, establish identities and policies, manage lifecycles, evaluate performance, observe outcomes, and control costs.

That scope extends beyond Agentforce. Salesforce says the control plane is intended to manage both Salesforce and third-party agents, reflecting a world where organizations use multiple models and agent platforms.

This multi-vendor position creates an important tension. Salesforce wants Koa to handle more CRM reasoning, but it also expects customers to continue using outside models and agents.

The control layer is therefore strategically broader than Koa. If Salesforce becomes the place where enterprises govern agents, it can remain central even when another company provides the underlying intelligence.

Security Mesh adds another part of that strategy by bringing signals from multiple security tools into a shared view. Consolidated signals can help teams recognize risk patterns that remain hidden when identity, configuration, data, and agent activity are reviewed separately.

Still, the announced architecture is not fully available. Salesforce says many foundation technologies already exist, while new capabilities and the unified experience are planned to begin rolling out in early fiscal 2028.

That timetable matters. Enterprises cannot evaluate a control plane through architecture diagrams alone. They need documentation, supported integrations, policy behavior, incident logs, latency measurements, and clear responses when an agent crosses a boundary.

Salesforce’s own Agentforce security guidance correctly emphasizes monitoring, permissions, data protection, and recovery. The difficult question is whether those controls remain consistent across third-party models, headless interfaces, and external tools.

Model Context Protocol, or MCP, gives agents a standard way to discover and invoke tools. It increases interoperability, but it can also expose agents to malicious or misleading tool implementations.

Salesforce researchers have separately proposed ToolGuardian, a framework that checks agent-tool interactions against declarative security policies. That work reinforces the core design principle behind the Dreamforce announcements: authorization must live at the tool boundary, not inside a model’s intentions.

For enterprise buyers, the relevant test is not whether an agent can explain a security policy. It is whether the platform prevents an action when the model ignores, misunderstands, or is manipulated around that policy.

The Real Contest Is Enterprise Control Versus Frontier Intelligence

Salesforce is betting that specialized reasoning plus governed context will beat unrestricted model capability on the workflows businesses actually automate.

This is not a simple Salesforce versus OpenAI contest. Salesforce continues to support models from OpenAI, Anthropic, Google, and other providers within its platform.

The disagreement concerns where enterprise value accumulates. Frontier labs emphasize general intelligence that improves across many domains. Salesforce emphasizes the operational layer where data, policies, tools, and business consequences meet.

Koa gives Salesforce greater control over one part of that stack. It can tune the model around CRM behavior, host inference inside its trust boundary, and optimize how Agentforce routes applicable workloads.

That control can also affect economics. Specialized models can use fewer tokens or shorter reasoning paths for familiar tasks, although Salesforce has not published enough independent production data to establish broad savings.

Frontier providers retain major advantages. Their models lead several public benchmarks, support a wider range of tasks, and improve on release cycles that enterprise software companies may struggle to match.

Salesforce therefore needs model routing to work well. Straightforward CRM tasks may go to Koa, while harder requests could still require a more capable frontier model.

Routing introduces its own complexity. The platform must predict task difficulty, understand security requirements, compare expected accuracy, and account for cost and latency before choosing a model.

A poor routing decision can eliminate the benefits of specialization. Sending a difficult task to a weaker model increases failure risk, while sending every task to a frontier model reduces Koa’s practical value.

The company also needs to prove that enterprise context stays accurate. Agents cannot make dependable decisions from outdated account records, contradictory policies, or incomplete knowledge.

This makes data governance part of model performance. An intelligent agent grounded in unreliable information can fail more confidently than a simpler system.

The strongest version of Salesforce’s case is therefore architectural. Koa handles specialized reasoning, the AI Harness supplies governed context, Guardian limits access, and the control plane observes behavior across vendors.

The weakest version is a collection of overlapping product names whose integration remains incomplete. Salesforce must show that administrators can configure and audit the system without creating another layer of operational complexity.

Customers should also distinguish deterministic controls from model-based monitoring. A permission enforced by an identity system is stronger than an AI classifier predicting whether an action seems risky.

The best design uses both. Deterministic rules should block actions that must never occur, while monitoring models can identify unusual behavior that fixed policies did not anticipate.

That tradeoff separates a useful enterprise agent platform from a persuasive keynote. Salesforce has described the components. Production evidence must show that those components work together under real workloads.

Three Signals Will Show Whether Salesforce’s Strategy Works

The next test is not another benchmark headline. It is whether customers adopt Koa, trust the controls, and keep Salesforce central in mixed-model environments.

The first signal is production availability and routing behavior. Salesforce needs to disclose when Koa becomes broadly available, which Agentforce tasks can use it, and how customers can select or avoid it.

Useful evidence would include routing criteria, latency, token consumption, failure rates, and comparisons using customer-defined workflows. If Koa handles meaningful CRM work with fewer errors, Salesforce’s specialization argument strengthens.

If Koa remains limited to demonstrations or narrow previews, frontier models will continue doing most difficult reasoning. That outcome would weaken the claim that Salesforce can own more of its AI stack.

The second signal is the rollout of the AI Control Plane and associated security controls. Enterprises need concrete dates, supported third-party platforms, policy definitions, audit formats, and incident-response workflows.

The strongest proof would be consistent enforcement across Agentforce, outside agents, MCP tools, APIs, and headless interfaces. Security teams should be able to identify who authorized an agent, what it accessed, which actions it attempted, and why the platform allowed them.

A delayed or fragmented rollout would leave customers assembling controls from multiple products. That would undercut the value of Salesforce’s unified architecture.

The third signal is independent customer evidence. Salesforce has published benchmark scores and selected customer stories, but enterprises need longer-term data from varied deployments.

Important measures include successful task completion, human escalation rates, unauthorized-action blocks, recovery events, and the effort required to maintain agent specifications.

Customer adoption should also reveal whether Koa expands Agentforce use or simply replaces one model behind existing workflows. Expansion would support Salesforce’s claim that specialized reasoning unlocks more complex automation.

Replacement without increased usage would still reduce dependency on frontier providers, but it would represent a smaller strategic win.

The Salesforce Koa model gives the company a credible technical answer to growing pressure from general-purpose agents. It turns Salesforce’s CRM experience into training scenarios and connects that model to governed enterprise actions.

The agent security tools address the harder half of the problem. A model that can act across corporate systems needs controls that remain reliable when its reasoning does not.

Salesforce has now defined the contest clearly. Enterprise AI will not be judged only by which model answers the hardest question. It will be judged by which platform can turn context into authorized action without losing visibility or control.

For technology leaders, the practical next step is to test the complete workflow. Measure the model’s decisions, inspect every tool call, challenge its permissions, and verify that recovery works before expanding autonomy.