Agentforce
When the customer sends a photo: building image input into an Agentforce agent
A customer uploads a picture of the cracked device and your text-only agent asks them to describe it. The image was the description. Agentforce can read images and PDFs through a vision-capable model in a prompt template, but the Trust Layer masks text, not pixels. Here's how to wire it, and the governance nobody mentions.
A customer uploads a photo of a control panel, one fault code lit, then asks what it means. Your agent replies: “I’d be happy to help. Could you describe the issue you’re seeing?”
The customer already did. They photographed it. The agent just could not look.
That moment is where a service agent leaks trust. People reach for the camera because a picture is faster and more accurate than a paragraph. An agent that treats the attachment as noise feels broken in a way a text-only bot from 2019 did not.
The good news: Agentforce can read the picture. The image and PDF plumbing has been generally available since 2025, and turning it on is a build task, not a wait-for-the-roadmap task. The part that needs care is not the wiring, but what happens to what is in the image.
Multimodal is already shipping, through prompt templates
The capability lives where grounding already lives, in prompt templates. Salesforce made image inputs to prompt templates generally available in Prompt Builder in 2025, with PDF support following the same year, and framed it openly as the first step in bringing multimodal to Agentforce.
The Field Service mobile app carries the same idea to technicians. A worker sends a photo into the conversation with the agent and gets troubleshooting help back from what the image shows.
So the status is not a pilot you are waiting on. Image and PDF understanding is a released building block. What Agentforce does not hand you is a single toggle that says “let the customer-facing agent see photos and figure it out.” You assemble it from three parts: a prompt template that accepts a file, a model that can see, and a channel setting that lets the customer attach the image.
How the picture becomes something the agent can use
The mechanism is a prompt template with a file input, and the flow is worth being concrete about.
You build a Flex prompt template that takes two inputs: a File (a ContentDocument, the uploaded image or PDF) and whatever text context you want alongside it. Inside the template you write the instruction and select a model that supports image inputs. A working instruction reads like this:
Read the attached photo of a returned product.
Describe, in plain text:
- the visible damage
- the model number, if legible
- whether the packaging is intact
If the image is unreadable, say so instead of guessing.When the agent invokes that template as an action, it passes the customer’s uploaded file in, the vision model reads it, and the template returns text. That returned text, the description of the damage, is now ordinary grounding the agent reasons over to answer, open a case, or route to a human.
Two supporting pieces make it real in a live conversation. The customer has to be able to send the file, which in a messaging channel means enabling attachments in that channel’s settings. And the analysis is just an action, so it composes with everything else.
You can hand the returned text to a custom Apex action exposed through @InvocableMethod, write it to the case, or feed it into the next step of a plan. The image never has to be the whole interaction. It becomes one grounded input among several. If you have wired a first service agent end to end, this is the same action pattern with a file on the front.
A vision model turns a photo into text the agent can reason over. The build question is never “can it see.” It is “what do we do with what it saw, and what was in the frame we did not want to send.”
The model has to be able to see
The quiet failure here is a text-only model behind a multimodal template. Vision is a property of the model, not of Agentforce, so the template only works if the model you selected supports image inputs. Pick a text model and the image is effectively dropped. The agent answers from the words alone, and nobody gets an error that says “I couldn’t see the picture.”
Salesforce’s documented file-input examples have been vision-capable models such as a GPT-4o mini and a Gemini Flash variant. The supported-model roster refreshes every release and old model IDs get rerouted, so do not hard-code a name from a blog.
Open the current supported-models list, confirm which selectable models handle image inputs, and choose inside the template deliberately. The choice is the same model-selection discipline every build needs, with one added axis. Capability, on top of latency and cost, decides whether the feature functions at all.
The governance gap: the Trust Layer masks text, not pixels
This belongs on the whiteboard before you build anything. The Einstein Trust Layer masks sensitive data before a prompt reaches the model, and it does that by detecting patterns and entities in text: names, emails, phone numbers, card numbers in the prompt’s words and fields.
I could not find any Salesforce statement that it scans or masks the contents of an image, and the masking is documented as working over text. So the safe assumption, until you confirm otherwise for your org, is that a face, a driver’s licence, a handwritten account number, or a card sitting in an uploaded photo reaches the vision model unmasked.
The exposure is real, and easy to miss because the text path feels safe. A customer troubleshooting a bill photographs the whole statement, account number included. Someone proving a warranty claim sends an ID. The pixels go to the model unredacted, even though the same data typed into the chat would have been masked.
Treat image input as an unmasked channel and design around it. Scope the feature to use cases where sensitive imagery is unlikely, and tell customers what to photograph and what not to. Add guardrails that keep the agent from echoing anything it read off an image into a place it should not live.
Retention matters too. Confirm how long uploaded files persist and where, because an image store is a different privacy surface from a transcript.
Limits and cost, with the usual caveat
The published constraints on file inputs to prompt templates are, as reported, on the order of ten images and about 15 MB total per request, with images as JPG or PNG and PDF supported. Individual models impose their own smaller limits, and post-processing can push a file over the edge so it gets dropped.
Read the current Prompt Builder limits page and your chosen model’s limits rather than trusting a round number, because this is exactly the kind of figure that shifts between releases.
On cost, the meter is the same one every agent action runs on. A standard action bills a flat rate regardless of the model behind it, and I found no documented surcharge for an image action specifically, so do not assume vision costs extra credits per action.
What can bite is the same trap as any heavy retrieval. A large image or a long PDF is a lot of content to process, and oversized content is where a single action can tip into being billed as more than one. The Flex Credit optimization levers apply unchanged: right-size what you send, do not push a ten-page PDF through when one page holds the answer, and verify the current rate card before you model volume.
Where it earns its place, and where it doesn’t
Image input is strongest where a photo carries information a customer struggles to describe and a misread is cheap to catch. A damaged-product or warranty photo the agent uses to triage a return. An equipment shot a field technician sends for troubleshooting. A receipt it extracts a total from. A screenshot of an error.
In each of those, the agent proposes and a human or a downstream check confirms, so a wrong read costs a re-ask, not a bad outcome.
The feature is weakest exactly where teams are tempted to lean on it hardest: as the sole basis for a high-stakes decision. Vision models hallucinate about images the way language models hallucinate about facts. They are brittle on handwriting, dense tables, and cluttered UI screenshots, where a small misread flips the meaning.
The failure mode that matters in an insurance or claims context is not “the model refused,” but “the model read the number confidently and got it wrong.” So keep a human in the approval seat for anything a misread would make expensive, and treat the image analysis as evidence the agent gathers, never as the ruling it issues.
Adaptive response handling draws the same line for any generated output: the agent can produce it, and something still has to check it before it counts.
What I would do
Turn it on for one narrow, low-sensitivity use case first. Damaged-product triage or an equipment photo in a service flow is ideal. The value is obvious, the privacy exposure is manageable if you tell customers what to send, and a wrong read is easy to catch.
Build the Flex template, pick a vision-capable model on purpose, enable attachments on the channel, and watch real transcripts. Do the governance work before you widen it, not after. Decide what happens to an image that arrives full of PII you never asked for, because on the current evidence the Trust Layer will not catch it for you.
Get that answer right on one flow, and multimodal stops being a demo trick and becomes a faster way for a customer to tell your agent what is wrong.
Understanding the basics
Can an Agentforce agent read images and PDFs?
Yes. Salesforce made image inputs to prompt templates generally available in Prompt Builder in 2025, with PDF support the same year, and the Field Service mobile app lets technicians send photos to the agent. For a customer-facing agent you assemble it from a Flex prompt template that accepts a file, a vision-capable model, and a channel setting that lets the customer attach the file. The model reads the image and returns text the agent reasons over.
What models support image input in Agentforce?
Image understanding is a property of the model, so you must select a model that supports image inputs inside the prompt template; a text-only model silently ignores the picture. Salesforce’s documented examples have been vision-capable models like a GPT-4o mini and a Gemini Flash variant, but the supported-model list changes each release, so check the current roster and confirm which selectable models handle images before you build.
Does the Einstein Trust Layer mask PII inside uploaded images?
The Trust Layer’s data masking is documented as detecting sensitive data in text and fields, and there is no published indication that it scans the contents of an image. The safe assumption is that PII visible in a photo, an ID, a card number, a face, reaches the vision model unmasked, even though the same data typed as text would be masked. Redact or scope image use accordingly and confirm the current behaviour for your org.
What file types and sizes can an Agentforce prompt template accept?
Reported limits are on the order of ten images and roughly 15 MB total per request, with images as JPG or PNG and PDF supported, though individual models impose smaller limits and post-processing can push a file over the cap. Confirm the exact numbers on the current Prompt Builder limits page and against your chosen model’s own limits before you rely on them.
Want a service agent that can read what your customers send it, built with the privacy question answered first? Talk to us. Scoping multimodal to where it helps, and fencing it where an unmasked image would bite, is the kind of agent work we do against real transcripts.
