How to Build Agentic Agreement Workflows with Docusign and Salesforce

Prefer to watch? Lawan Likitpunpisit, Lead Product Manager, and Kevin Liu, Software Engineer, recorded a walkthrough of this integration ahead of their Salesforce TDX session on the topic. Watch the recording below, then read on for the deep-dive.

Enterprise sales reps spend roughly 28 hours a month opens in a new tab managing, searching for, or recreating sales documents. Up to 42% of a sales team's time is lost to tool-switching and close to 70% of total working hours go to administrative tasks, leaving a narrow window for actual selling.

The architectural response to this is agentic workflows: systems that execute end-to-end processes, reason across contract data, and handle transitions between systems without waiting for a human to trigger each step.

This post walks through how to build that with Docusign IAM and Salesforce Agentforce by connecting Navigator, Iris, and Maestro to Agentforce so your agents can handle the full Discover → Query → Act → Review pattern through natural language, directly inside the CRM.

The architecture: two layers working together

The Docusign IAM and Agentforce integration works because the platforms work together creating a complementary functionality needed for agreement automation. Agentforce provides the natural language interface, reasoning layer, and orchestration engine embedded in the CRM where reps already work. It handles the "understand what was asked and figure out what to do" part.

Docusign IAM provides the authoritative agreement layer:

• Navigator: An AI-powered contract repository that indexes and surfaces agreement data, including renewal dates, contract values, and clause content

• Iris: The AI layer for clause-level contract queries. Reps access it through an embedded Iris Chat component on the CRM record page, separate from the Agentforce natural language interface. 

• Maestro: The workflow engine that handles multi-step agreement processes: generating documents from templates, injecting dynamic data, and routing for review and signature

When you connect these through a custom Agentforce action, a rep can go from "which accounts are up for renewal?" to a draft agreement sent to the customer without leaving Salesforce or opening a document manually.

What the workflow looks like in practice

The Discover → Query → Act → Review pattern plays out across five stages, all from within Salesforce.

Discover:  A new rep wants to understand which accounts are coming up for renewal. Instead of digging through records, he asks Agentforce: "What are my top accounts coming up for renewal?" Agentforce calls the Docusign Navigator API and returns a ranked list, each with contract value and renewal date, directly in the chat. 

Query: Before drafting a renewal, the rep checks whether the existing agreement has a price cap. From the CRM record page, he opens Iris Chat in the embedded Navigator component and asks in natural language. Iris surfaces the relevant clause,  a 5% uplift provision, with a reference to where it appears in the contract.

Act: The rep asks Agentforce to generate a renewal agreement and kick off the negotiation process. Agentforce triggers an Apex action that calls the Docusign Maestro workflow API, using a legal-approved template with updated terms applied. Before the workflow fires, the rep reviews an intake form pre-populated with Salesforce data (no manual entry) and submits.

Track: A new Docusign Agreement Request appears on the originating Salesforce record immediately. Status updates in real time through the redlining and signature stages without the rep leaving the CRM.

Review: Once the agreement reaches the signer, they can use Iris to generate a summary and ask questions about specific terms without reading the full contract. After signing, the completed agreement is available on the opportunity record with key terms already extracted by Iris.

Planning and scoping your integration

Before writing code, define your integration scope and confirm you have the right modules. Here's a recommended sequence to follow:

1. Confirm you have Docusign IAM for Sales or Docusign IAM for Enterprise with Salesforce connector. 

2. Create Docusign workflows, request type, and document templates

3. Secure API connections using Salesforce Named Credentials

4. Define Agentforce topics and scoped instructions for each agreement task

5. Build Apex actions as the bridge between Agentforce and Docusign APIs

6. Test in sandbox with real-world edge cases before go-live

An architecture diagram can also help orient your team before you start building. A simple swimlane or flow diagram showing Salesforce CRM / Agentforce → Apex Action → Docusign APIs (Navigator / Iris / Maestro) → back to Salesforce makes the bidirectional data flow easier to reason about.

Start with a data-mapping exercise to identify which Salesforce objects connect to which Docusign templates, and in which direction data flows:

This alignment ensures your CRM data structures map cleanly to agreement templates before you start building and reduces the field-mismatch bugs that are painful to debug later.

A typical end-to-end sequence:

1. Agreement generation triggered by an agent event or manual prompt

2. Agreement routing based on signer role or conditional logic

3. Real-time status updates written back to Salesforce

4. Completed agreements stored in Navigator and linked to the CRM record

For advanced configurations, Docusign Iris can extract clauses and summaries directly into Salesforce, giving agents and approvers a concise view of key deal terms in context.

Implementing topics and actions

In Agentforce, agent behavior is defined through topics and actions. Topics provide the instructions and guardrails; actions (Apex classes) provide the technical connection to Docusign APIs. 

1. Define the Agentforce topic

Each topic is essentially a job description for the agent: it picks the right topic based on what the user says, then executes accordingly. Create a specific topic for each discrete agreement task, with instructions that tightly restrict the agent's scope. For example: "Only trigger a renewal workflow if the Opportunity stage is 'Discovery' and the Navigator API confirms an upcoming expiration."

A few patterns that work well in practice:

• Create distinct topics for discrete tasks ("Send agreement," "Check status," "Escalate review") rather than handling everything in one topic

• Write explicit prompts ("Ask for Account ID before sending an agreement") to prevent agents from acting on ambiguous input

• Define guardrails that restrict sensitive operations unless specific fields or approval conditions are met

• Use multi-turn instructions to tell the agent to wait for user confirmation before proceeding. This is how you build the intake form review step into the flow.

2. Build the Apex action

Each Agentforce action is configured with instructions that define when and how it fires, and is tied to a single Apex class. When Agentforce invokes the action, the Apex class executes and calls the Docusign API. This is the bridge that lets Agentforce pass conversational context (like an Account ID or a clause value surfaced by Iris) into a Docusign Maestro workflow.

A key design principle: actions return state, they don't contain logic. Rather than writing conditional logic in Apex, each action returns a structured response—a success boolean and supporting fields like a status message—and the topic instructions reason over that state to decide what happens next. Actions are the tools; topic instructions are the logic. Keeping them separate is what makes the integration maintainable as it scales.

// Example: Triggering a Maestro workflow from Agentforce
public class DocusignMaestroAction {
    @InvocableMethod(
        label='Execute Renewal Workflow'
        description='Triggers Docusign Maestro to generate and send a renewal.'
    )
    public static void triggerRenewal(List<RenewalRequest> requests) {
        for (RenewalRequest req : requests) {
            // Call the Maestro API using Salesforce Named Credentials
            // Pass the Account ID and uplift value from the renewal opportunity
        }
    }
}

The @InvocableMethod label and description are what the agent reads to decide when to call this action, not the underlying code. Write them to be unambiguous.

3. Secure your API connections

Use Salesforce Named Credentials to store Docusign API authentication details. You can define them once and reference them in your Apex actions without exposing secrets in code. 

 For a deeper walkthrough of how to use Named Credentials, Apex callouts, and a Lightning Web Component to sync Navigator agreement data into structured Salesforce fields, see How to Ground Agentforce with Docusign Navigator Agreement Data. 

Apply least-privilege permissions through Salesforce profiles: each agent should only have access to the objects and actions it actually needs.

The request flow looks like this:

• Agentforce invokes the action, which executes the configured Apex class

• The Apex class uses named credentials to call Docusign's API

• The response updates Salesforce with envelope status and a link to the agreement

This model isolates API authentication and ensures every transaction is accountable across both systems.

Testing in sandbox

Before going live, validate workflows in a Salesforce sandbox using test records and dummy templates. Agentforce Testing Center lets you simulate real interactions and observe how agents handle different agreement scenarios.

Plan for non-deterministic behavior: because AI agents can produce slightly different outputs across runs, you need repeated testing across diverse inputs to verify stability, not just a single happy-path pass. Use strict topic instructions and guardrails to define exactly which Docusign templates are authorized for specific account types, preventing the agent from selecting the wrong agreement.

A solid pre-launch checklist:

• Edge case handling (missing fields, conflicting data, incomplete records)

• Fallbacks for policy-violating actions

• Audit logging validation

• Traceability for every automated signature or handoff

Governance and trust

The Docusign and Agentforce integration inherits the governance layers that both platforms already enforce. Docusign's admin controls, permissions model, and identity verification carry over directly into the agentic workflow. An agent can only access agreements and data that the authenticated user is entitled to see, and every action is logged and traceable.

Agentforce adds its own trust controls on top, including human-in-the-loop escalation when an action falls outside the agent's confidence threshold.

You should build approval gates into workflows that touch agreements with financial or regulatory significance. Agents should always escalate to human reviewers when ambiguity or compliance thresholds are reached. Define what those thresholds are before you go live.

Monitoring and iterating in production

After launch, log all transactions, trace agreement IDs, and track the metrics that tell you whether the workflow is performing:

An agent-generated exception (e.g., when an agent triggers an unexpected outcome or fails a rule) is a signal to review your topic configuration, not just a one-off error to dismiss. Build feedback loops that route ambiguous tasks back to human reviewers, and use that real-world signal to refine topic instructions and prompts over time.

What's coming: MCP

The current integration pattern uses custom Agentforce actions and Apex classes to connect to Docusign Maestro. Docusign is also working with Salesforce on Model Context Protocol (MCP) support, which would replace much of that custom wiring with a standardized, discoverable connection layer. This makes it significantly easier to expose Docusign's capabilities to Agentforce and other agentic platforms.

If you're building this integration today, the custom Apex action pattern is the right approach. If you're planning integrations that span multiple platforms, keep an eye on MCP.

Frequently asked questions

How do I handle non-deterministic AI responses in agreement workflows? Use strict Agentforce topic instructions and guardrails. Define exactly which Docusign templates are authorized for specific account types to prevent the agent from selecting the wrong agreement.

Can Agentforce query specific clauses inside a contract? Not directly. The two interfaces handle different things. Agentforce Chat handles orchestration: understanding what you're asking and figuring out what to do across Salesforce and Docusign. Clause-level contract questions run through Iris Chat, a separate embedded component on the CRM record page. When a rep needs to check a specific term like a termination notice period or a liability cap, they open Iris Chat, which reads the agreement and surfaces the relevant clause with a reference to its location in the contract. The rep can then apply that value to the renewal opportunity, where it's picked up by the Maestro workflow when the contract is generated.

This is expected to change later in 2026, when Docusign MCP support for Agentforce is planned to allow clause-level queries directly through Agentforce Chat.

How does Maestro handle redlining? Maestro can be configured to route agreements to an "Agreement Request" status where external parties can redline. The agent can track the status of those requests through the Docusign API.

How do I ensure secure API access for Agentforce agents? Use Salesforce Named Credentials to manage Docusign API authentication and apply least-privilege permissions through Salesforce profiles. Never embed credentials in agent logic or topic instructions.

How do I manage post-signature data syncing with Salesforce? Configure Docusign Connect write-backs to automatically update Salesforce records when agreements reach "Completed" status.

Further reading

• Docusign Navigator API Reference

• Introduction to Docusign Maestro

• Salesforce Agentforce Developer Guide

• How to Ground Agentforce with Docusign Navigator Agreement Data

• Resources for building agentic agreement workflows with Docusign and Salesforce