Salesforce is the destination customers ask about first and the one where forward deployed engineering is most obviously a job. Every org is different: custom objects, validation rules, sharing models, profiles and permission sets built over a decade by people who have left. This is why the page below describes the problem rather than a shipping product.
Available today
The adapter is real and something is incomplete, either a part of the destination or real-provider proof for part of the lifecycle. The gap is stated on the page rather than discovered during an evaluation.
What a forward deployed engineer does by hand today.
A managed or unmanaged package, or a Connected App, installed into a sandbox first and then promoted to production through the customer's own change process. There is no version of this that takes an afternoon.
The person whose calendar decides your go-live date.
A Salesforce administrator, and usually a change advisory board as well. In regulated industries the sandbox-to-production promotion is a scheduled event, not a request.
Whose identity the product acts as, and where that grant lives.
OAuth 2.0 against the customer's org, with the JWT bearer flow for server-to-server. Connected App policies, IP restrictions and permitted-users settings all decide whether a grant works, and all of them are the customer's.
The repeatable half, turned into software.
The Connected App OAuth flow, with sandbox and production as separate environments, recording the org's instance url because every call must go there, per-environment credential storage, and validation that runs a real query and checks the fields came back. Field level security hides data by omitting it rather than failing, so a check that only counted rows would call a broken deployment healthy.
The half that is theirs and should stay theirs.
The org. Its objects, its sharing rules, its profiles, its change process, and the decision about what a package is allowed to read.
How capabilities map onto what the platform will let you do.
Object and field level security, permission sets, sharing rules. A capability that reads an Opportunity is not one permission, it is a profile, a permission set and a sharing model that has to agree.
What has to execute before anyone is told it works.
Executing against a sandbox, then against production, and treating those as different environments rather than the same one twice.
Rotation, expiry, revocation, and who notices first.
Refresh tokens with org-level revocation. Connected App policy changes can invalidate a grant without anything failing until the next call.
What happens to this customer when you ship version four.
Package versions and org state are separate axes, and an upgrade can succeed while leaving the org in a configuration the new version does not expect. This is precisely the problem the deployment control plane exists to model.
What actually goes wrong, named rather than generalised.
Field level security silently returning nothing rather than an error. Governor limits under load. A sandbox refresh wiping configuration. A validation rule written in 2019 rejecting a record the integration creates.
How you learn it broke without the customer telling you.
The three layers, with the org's daily API allowance watched. That allowance is shared with everything else the customer runs, so exhausting it degrades Salesforce as a named dependency rather than reporting your product as broken.
The adapter is real and something is incomplete, either a part of the destination or real-provider proof for part of the lifecycle. The gap is stated on the page rather than discovered during an evaluation.
The adapter is complete and every path is covered by tests against a provider simulator, which proves our logic and not the provider's. Not yet exercised with real provider credentials: authorization, installation, execution, refresh and reconnect, validation, failure handling.
Lifecycle coverage
This label is generated from a proof registry in the deployment code, not written on this page. A destination cannot read Available until every lifecycle path above has actually run against the real provider, and a test refuses the claim without dated evidence.
Connect a source, publish, and send one link. Your next enterprise customer installs itself.
2 customer environments free, forever. No card required.
