Salesforce Winter '27: Flow Gets Real Testing, Security Gets a Deadline

Everyone Forwards Me the Agentforce Headlines. Nobody Forwards Me the Sandbox Cutoff.

The Winter '27 release notes went live on August 18, a day ahead of the announced date, and by that afternoon my inbox had its usual shape. Three forwarded links about Agentforce. A LinkedIn post asking whether this is the release where agents finally get real. Nothing at all about August 27.

August 27 is the date that decides whether you get to test this release or merely receive it. Everything else here is downstream of it.

The Only Part of This Release With Hard Deadlines

| Date | What happens |
| --- | --- |
| August 13, 2026 | Prerelease and partner org signup opened |
| August 18, 2026 | Release notes published |
| August 27, 2026, 6:00 p.m. PT | Sandbox cutoff. Where your sandbox sits at this moment decides whether it gets Winter '27 |
| August 28-29, 2026 | Preview instance sandboxes upgrade |
| August 30, 2026 | Testing opens |
| September 4-5, October 2-3, October 9-10, 2026 | Production release weekends, Friday evening into Saturday |

One honest caveat about that last row. The community write-ups do not agree on the production weekends. Some list the Friday dates, some list the Saturday dates, and at least two well-regarded sites put the first wave in late August rather than early September. Release weekends running Friday evening into Saturday explains part of the spread, but not all of it.

So do not take that row, or anyone else's version of it, as your date. Open Setup, go to Company Information, find your instance, and look it up on the Salesforce Trust maintenance calendar. It takes ninety seconds and it is the only source that is actually about your org.

The date I would treat as fixed is the cutoff. Miss August 27 and you do not get a preview sandbox, which means your first exposure to Winter '27 is production. I have watched orgs discover a broken integration on the Monday after a release weekend. It is a bad way to spend a Monday.

Flow Got the Biggest Upgrade in Years

Salesforce Ben counts seventeen Flow changes in this release. Most cycles I skim a list like that and find one thing worth telling a client about. This time there are six.

Flow Test Mode (Beta). Flow Builder now has separate Build and Test modes, with mock outputs, assertions, code coverage, and reusable test scenarios. This is the item I would have asked for if anyone had asked me. Flow testing has existed in a thin form for years and almost nobody used it, because it lived away from where you build. Putting it behind a mode toggle inside the builder is the difference between a feature that exists and a feature that gets used.

Flow Version Edit History. A button that shows every change made to a version and who made it, with the option to restore it, save it as a new version, or spin it into a new flow. If you have ever stood in front of a flow that worked last week and tried to reconstruct what changed from three admins' memories, you know what this is worth. This is the one I expect to save the most hours.

Screen Flows in Mass Actions. You can now launch a screen flow against multiple records from a list view or a related list. The selected record IDs arrive in a text collection variable, and from a related list you also get the parent record ID. This closes a gap people have been filling with custom Lightning components for years. A good share of the "we need a developer for this" requests I get for bulk operations are now a screen flow.

Split by Field Value and Split by Date. Two simplified Decision elements. The first splits on a field value, the second on a date, with Before, Between, After, and Is On operators. These are convenience wrappers rather than new logic, but the date one removes a formula resource that nearly everyone builds slightly wrong the first time.

Flow Tags. Tag flows across categories when you save them, then browse them in the Automation app. Sounds cosmetic. It is not, if you are the person inheriting an org with four hundred flows and no naming convention.

The Flow Builder cleanup. A new setting to hide API names and collapse labels and descriptions, a right-side element menu grouped by type with your frequent picks on top, and generally tighter cards. Small things, but you are in that canvas all day.

The rest is quality of life: a colour picker in Display Text and text templates, a time screen component with configurable range and interval, and a filter to hide unused resources. Good additions. Nobody is changing a rollout plan for them.

Three Access Changes That Can Actually Break Something

The line I keep repeating to clients: features are opt-in and safe to ignore until you are ready. Release Updates are not. They arrive whether you prepared or not, and they are where release-weekend incidents come from.

Email change verification, and the domains behind it. Salesforce is retiring Support's ability to disable the email change verification requirement in October 2026. If your org has ever had that switched off, usually because someone needed to run a bulk email update during an HR migration or a rebrand, that escape hatch is closing. To make bulk user email changes at scale afterwards you need either a DKIM key or Authorized Email Domains configured. Authorized Email Domains shipped as an opt-in Release Update in Summer '26 and is heading toward enforcement. Check it now, not in October.

The OAuth 2.0 username-password flow is being retired. Flagged since Summer '26 for connected apps. Nearly every org I have looked at has at least one integration still on it, usually something old, usually something nobody owns any more. That is precisely the problem: the integrations on this flow are the ones with no listed owner. Go find them.

Profile filtering. Users without the View All Profiles permission will only see their own profile. Sensible hardening. It also breaks any place where a non-admin picks a profile from a list, which includes some assignment screens, some managed packages, and a lot of homegrown user-provisioning flows.

One more worth saying plainly: Release Updates you previously deferred are being pulled into Winter '27 for enforcement. Deferring is a real strategy right up to the release where it stops being offered. If your Release Updates page holds a comfortable pile of postponed items, this is the release where that pile comes due.

Agentforce: What Actually Shipped Versus What People Are Guessing

Here I want to be careful, because most of the Winter '27 Agentforce material circulating right now is prediction dressed as reporting.

What is real: Setup with Agentforce is generally available. It requires both Agentforce and Data 360 enabled, both of which are included in Salesforce Foundations. Its associated Release Update became available in Spring '26 and is enforced in Winter '27, so it is not something you get to keep postponing.

What is not confirmed: new prebuilt agent templates, expanded Atlas Reasoning Engine capabilities, industry-specific agent configurations, and new governance and observability tooling. All four appear in "what to expect from Winter '27" posts. None of them appeared in the release notes as of writing. They are educated guesses, and the more careful writers say so in a sentence you have to scroll to find.

The reason for the guessing is straightforward. Dreamforce runs September 12 to 14, and the pattern is that Dreamforce announcements start reaching general availability in the release that follows. Winter '27 is the plumbing release before the announcement, not the announcement itself. Scope your testing accordingly.

Are You Actually Affected?

| Your situation | Action |
| --- | --- |
| Heavy Flow org, several admins in the same flows | Highest upside in this release. Get a preview sandbox and try Test Mode and Edit History |
| You run bulk user email updates | Act before October. Configure DKIM or Authorized Email Domains |
| Integrations using the OAuth username-password flow | Audit now. Find the unowned ones and migrate them |
| Non-admins pick profiles anywhere in your UI | Retest those screens in preview |
| Order Management with cancellation or return fees | Retest cancellations with fees, blind returns with fees, and return orders with fees |
| Release Updates page full of deferred items | Open it this week. Some of them land here |
| No sandbox refreshed before August 27 | You have no test window. Fix that first |

What Has Not Changed

Test Mode is Beta, and that word is doing real work. Do not retire your Apex coverage or your manual regression script because a beta feature now exists. Use it to catch the obvious break and keep the rest of your safety net.

The Split elements are wrappers over Decision. They make flows more readable; they do not let you express anything you could not express before. Read them as ergonomics, not capability.

Flow's actual weak spot is untouched. Building flows keeps getting nicer. Debugging a flow that failed in production overnight, with a fault path that swallowed the useful part of the error, is the same job it was two releases ago.

On Agentforce the constraint has not moved either. The data layer underneath still decides whether any of it works. Winter '27 does not change that, and no release will.

What To Do Right Now

1. Refresh or create a preview sandbox before August 27, 6:00 p.m. PT. This is the only irreversible item on the list. Everything else can be done late. This one closes.

2. Look up your own production date and put it in a shared calendar. Setup, then Company Information, find your instance, check it on the Salesforce Trust maintenance calendar. Then tell your support team, not just yourself.

3. Open the Release Updates page in Setup and work the backlog. Anything you deferred, anything scheduled for Winter '27, anything flagged around email verification or OAuth. That page is where release-weekend incidents get prevented.

4. Pick your three highest-risk automations and retest them in preview. Not all of them. Three. Prioritise anything touching user email changes, OAuth-authenticated integrations, or Order Management fees, and run them end to end before your production weekend.

Not sure which of your integrations are still on the retiring OAuth flow? Let's talk — I will help you find them before the release does.