aibot88 Salesforce architecture skill
Capacity model
| Limit class | Soft signal at |
|---|---|
| Storage (data + file) | 70% utilisation |
| Active users | 80% of license |
| Custom objects | 80% of edition cap |
| API calls | sustained > 60% of 24h limit |
| Async Apex slots | > 50% concurrent |
| Workflow/Flow per object | 5+ active |
| Triggers per object | > 1 (use a single dispatcher) |
When any soft signal is hit, surface it in the architecture review.
Sharing & security
Security model layers (top-down):
- Org-wide defaults (OWD)
- Role hierarchy
- Sharing rules (criteria/owner-based)
- Manual sharing
- Apex managed sharing
- Restricted views via field-level security & profile/permset
- Implicit sharing (parent ↔ child)
Review checklist:
- OWD set to most restrictive sustainable level (Private > Public Read Only > Public Read/Write)
- No "View All Data" / "Modify All Data" on profiles for non-admins
- Permission sets > profile permissions (more granular, easier audit)
- Field-level security explicit on PII fields
- Apex
with sharing/without sharingaudited per class
Integration patterns
| Pattern | When | How |
|---|---|---|
| Request-Reply (sync) | UI need-to-know now | Apex callout + Named Credential |
| Fire-and-forget | downstream system can be slow | Platform Events, Change Data Capture |
| Batch sync | volume, off-hours | Bulk API 2.0 from MuleSoft / fivetran / etc |
| Pub/sub | many subscribers, real-time | Pub/Sub API (gRPC) |
| Composite | multiple ops in one round-trip | Composite REST |
Multi-org
- Production + sandboxes: standard. Use Source Tracking.
- Multiple production orgs: integrate via Salesforce Connect / API / iPaaS, not direct DB
- Org strategy decisions: dictated by data residency, license cost, M&A history, business unit autonomy
Tech-debt assessment heuristics
Score the org on:
- Apex coverage (target > 85%)
- Active triggers per object (target ≤ 1, use dispatcher)
- Active Flows per object (target ≤ 3, consolidate)
- Custom fields per object (review at > 200, dangerous at > 500)
- API call volume vs limit
- Hardcoded ids in code/Flow (target = 0)
- Unmanaged metadata diff between orgs (target = 0 unintended)
Deliverable shape
When asked for an architecture review, produce:
- One-page summary — score + top 3 risks + top 3 wins
- Capacity table — current vs limit, headroom
- Risk register — risk, likelihood, impact, owner, mitigation
- Roadmap — quick wins (≤ 1 sprint), structural fixes (1 quarter), strategic bets (1 year)
Use diagrams (Mermaid) for: data model, integration topology, environment topology.