Configures Salesforce Shield Platform Encryption by generating the metadata that turns it on and choosing the right settings: which encryption scheme a field should use, which key-management model fits a requirement, and how the tenant-secret lifecycle works. This is a
hybrid
skill — it emits deployable
*.settings-meta.xml
/
*.field-meta.xml
where Platform Encryption exposes a real Metadata API surface, and returns grounded guidance where the operation is UI/REST-only.
Scope
In scope
choosing and applying
encryptionScheme
on a field; enabling deterministic encryption, Cache-Only Keys, External Key Management, and replay detection via
PlatformEncryptionSettings
/
EncryptionKeySettings
; explaining BYOK / BYOKMS / EKM / Cache-Only key models; tenant-secret rotation and destruction semantics; the query behavior of encrypted fields.
Out of scope
a plain custom field with no encryption (use
platform-custom-field-generate
); the raw Metadata API field reference (use
platform-metadata-api-context-get
); Classic Encryption (
EncryptedText
fields) — that is a separate, legacy feature; deploying/pushing metadata to an org (that belongs to a deploy lifecycle skill).
Required Inputs
Gather or infer before proceeding:
Question type
is the user asking for a
deployable artifact
(a settings file, an encrypted field) or
guidance
(which model, what happens when I rotate a key)? Deployable → generate XML from
assets/
. Guidance → answer from
references/
.
A question is guidance whenever the ask is to explain, confirm, or compare
— "is that right?", "what's the relationship?", "can we…?", "is there an ordering requirement?",
"explain the difference between X and Y", "which key model should we use?"
—
even if the user also says they are about to write, deploy, or author settings themselves.
The user writing settings is
their
action; it does not make the skill's deliverable a file. Only an explicit "generate / create / give me the file / here is my field, encrypt it" is an artifact request.
Key-model choice questions are guidance, not deployable metadata.
"Explain BYOK vs external key management / BYOKMS / EKM / Cache-Only", "which one keeps key material out of Salesforce?", "should we use BYOK or EKM?" → answer them in a
single markdown answer file
(the guidance write-up), not a deployable
*.settings-meta.xml
.
Naming the enabling setting in that answer (e.g.
canExternalKeyManagement
,
enableCacheOnlyKeys
) does NOT turn it into a settings artifact
— cite the field name inline in the answer file; do
not
emit an
EncryptionKey.settings-meta.xml
unless the user explicitly says "generate/create the settings file."
Field encryption target
(for field work): the object and field API name, and whether the user needs to
filter, sort, or group
on the field (drives deterministic vs probabilistic).
Key model
(for key work): whether keys are Salesforce-derived (default), customer-supplied (BYOK), stored in an external KMS (BYOKMS/EKM), or fetched on demand (Cache-Only).
Show more
Installs
840
Repository
forcedotcom/sf-skills
GitHub Stars
776
First Seen
14 days ago
Security Audits
Gen Agent Trust Hub
Pass
Socket
Pass
Snyk
Pass