Products

Resources

Pricing

Start a Salesforce trial

Quality Clouds for Salesforce · For developers and architects

Apex and Flow governance while you write, in the tools you already use

Livecheck checks the Apex class, the trigger and the Flow while you are still in the editor. Every finding tells you what it found, why it matters and how to fix it. Your architects decide which rules apply, so what you see is what your team agreed to care about.

See the rule catalog

Salesforce overview

For platform owners

For executives

Four places it checks your work. None of them is a meeting.

The same ruleset runs in all four. What passes in your editor passes in the pipeline.

In VS Code and Code Builder

Add the Quality Clouds extension to VS Code or Code Builder and every Apex class, trigger, Lightning component and Flow you touch is checked against the ruleset your org already uses.

In the Developer Console

The Chrome extension puts Livecheck inside the Salesforce Developer Console, so the code somebody writes directly in the org gets the same check as the code written locally.

In the pull request

The GitHub Action scans the branch and posts findings inline: file, line, severity, the rule and a link to the fix. Push another commit and it rescans. You never leave GitHub.

In your release pipeline

Quality Clouds runs against the promotion in Copado or Flosum, so a change that breaks the standard is caught before it reaches the next org rather than after.

Nothing here asks you to open another dashboard.

Rules written by people who have watched an org fall over.

Every finding names the rule, explains why it matters, links the documentation and estimates the time to fix. You never get a score without a reason behind it.

Avoid SOQL inside loops

The governor limit does not care that it worked fine against fifty records in a scratch org.

Avoid DML statements inside loops

Same story, different limit, and it usually surfaces halfway through a data load on a Friday.

Declare a sharing mode when using DML

Leave it implicit and you have quietly decided that your record visibility rules are optional.

Avoid business logic in triggers

One trigger with logic in it becomes four, and then nobody can tell you what order they run in.

Avoid unescaped variables in DML queries

SOQL injection is still injection. It just has a friendlier name in this ecosystem.

Avoid hardcoded credentials in endpoint calls

It works, it ships, and then it lives in your repository history forever.

Rules come from Salesforce’s own guidance, established JavaScript and Apex practice, data privacy requirements and the failure patterns we have seen across real orgs since 2015. The full catalog is public, filterable and documented rule by rule.

CHECKLIST

Is Your Salesforce Ready for AI Code?

AI agents now have live write access to production. Download the 12-point blueprint to secure your pipeline before they touch your metadata

Audit your MCP surface area to close open doors to Apex and Flow

Automate Quality Gates to catch security flaws at machine speed

Control token costs by stopping inefficient, runaway AI loops

Guarantee compliance with full audit trails for DORA and SOC 2

CHECKLIST

Is Your Salesforce Ready for AI Code?

AI agents now have live write access to production. Download the 12-point blueprint to secure your pipeline before they touch your metadata

Audit your MCP surface area to close open doors to Apex and Flow

Automate Quality Gates to catch security flaws at machine speed

Control token costs by stopping inefficient, runaway AI loops

Guarantee compliance with full audit trails for DORA and SOC 2

CHECKLIST

Is Your Salesforce Ready for AI Code?

AI agents now have live write access to production. Download the 12-point blueprint to secure your pipeline before they touch your metadata

Audit your MCP surface area to close open doors to Apex and Flow

Automate Quality Gates to catch security flaws at machine speed

Control token costs by stopping inefficient, runaway AI loops

Guarantee compliance with full audit trails for DORA and SOC 2

Configuration counts as code. So do your agents.

Apex classes, triggers, pages and components. Lightning and Lightning Web Components. Flows, workflow rules and approval processes. Objects, custom fields, layouts, profiles, permission sets, sharing rules and org config. OmniScripts, integration procedures and data transforms. And the Agentforce layer: AI Agents, AI Agent Templates, AI Topics and Prompt Templates, along with the data connectors and sources they ground on.

A permission set opened too wide does as much damage as a bad trigger, and no linter will ever see it.

Your standards, not ours.

The default ruleset is a starting point. What actually reaches your developers is whatever your architects decide it should be.

Rule Builder

Write rules for your own conventions. Naming, trigger frameworks, the pattern the team agreed in March and has quietly stopped following.

Rulesets per project

A project groups related orgs under one context. The main org carries the ruleset and the rest inherit it, so sandbox, UAT and production are held to one definition of good rather than three that quietly drift apart.

Quality Gates

Set the bar once and it applies in the pull request and in the promotion. You decide whether a failed gate blocks the merge or simply reports.

Write-offs and peer review

Some findings are wrong for your context. Write them off with a reason, route them through review, and propagate the decision across orgs so nobody argues it twice.

An exception path is not a weakness in a governance tool. Without one, teams route around the tool and you lose the signal altogether.

Tuned to be quiet.

A governance tool that cries wolf gets muted within a week. Three things keep the signal worth reading.

Only what you changed

Branch scans analyze the changes in the pull request, not the accumulated history of the org. You see your issues, not a decade of somebody else’s.

Severity you can act on

Every finding carries a severity and an impact area, so you can block on the serious ones, watch the rest, and put the line where your team wants it.

Switched off on the record

Rules that do not fit come out of your ruleset. Findings that do not apply get written off with a reason and a reviewer. Both are recorded, so the decision holds.

The aim is a developer who reads the findings, not one who has learned to scroll past them.

The agents you build can call it too.

Quality Clouds runs an MCP server, so anything that speaks MCP can call it. That includes the agents your team builds in Agentforce. An agent can pull the ruleset for an Apex class or a Flow, check what it just generated, and raise a write-off for review, with no human ferrying findings between systems.

Agentforce agent - tool: quality-clouds

> sf_get_rules(element: ‘Apex Class’, severity: ‘high’)

returns the active ruleset for that element type

> sf_analyze_element(‘OpportunityTrigger.cls’)

HIGH Avoid SOQL inside loops

Performance - documented fix - write-off available

> sf_request_writeoff(issue, reason)

routed to peer review, decision recorded

AI Agents, AI Agent Templates, AI Topics and Prompt Templates are scanned configuration in their own right, so the agents your team ships are governed the same way the code is.

Connect one org. No sales call.

The freemium account for Salesforce runs a real scan against a real org and hands you the findings. If it tells you nothing you did not already know, you have lost an afternoon.

Govern the code while you write it

Stay ahead of the curve in Salesforce

Salesforce

AI Code Governance

Agentic AI

Claudeforce makes Salesforce headless. Governance has to move with it

Taher Dohadwala

Sep 3, 2026

6 min read

Salesforce is going headless. Learn what changes and how to govern what the agents build

Salesforce

AI Code Governance

DevOps & CI/CO

Agentforce Vibes Governance: What Salesforce's New AI Coding Guardrails Mean for Your Org

Taher Dohadwala

Aug 10, 2026

7 min read

Salesforce is putting coding agent guardrails in DevOps Center. What the 6 policies cover, what they miss, and what to do about it.

Salesforce

DevOps & CI/CO

AI Code Governance

The Case for Native AI Code Governance in Modern Salesforce DevOps

Javier Luesma

Jun 4, 2026

5 min read

Discover why your governance must live inside your DevOps stack—not alongside it

Apex and Flow governance while you write, in the tools you already use

Four places it checks your work. None of them is a meeting.

Rules written by people who have watched an org fall over.

Rules written by people who have watched an org fall over.

CHECKLIST

Is Your Salesforce Ready for AI Code?

CHECKLIST

Is Your Salesforce Ready for AI Code?

CHECKLIST

Is Your Salesforce Ready for AI Code?

Configuration counts as code. So do your agents.

Configuration counts as code. So do your agents.

Your standards, not ours.

Your standards, not ours.

Tuned to be quiet.

Tuned to be quiet.

The agents you build can call it too.

Connect one org. No sales call.

Govern the code while you write it

Govern the code while you write it

Related articles