Governor Limit Risk Prediction Agent

As a Salesforce codebase grows, keeping every Apex class and trigger free of governor limit risks becomes increasingly difficult. Developers write code against deadlines. Reviews are inconsistent. And the structural risks — SOQL in loops, unbounded DML, cross-method callout chains — are invisible in a single-file review. They only surface when they cause a production exception under real data volumes:

• SOQL queries inside loops and bulkification gaps go unnoticed until they cause failures under load.
• Cross-method looped operations span multiple classes — invisible to any single-file peer review.
• Async transaction boundaries (Batch, Queueable, Future) each carry separate limit sets that developers may not account for.
• Recursive method patterns are flagged as looped operations — but their iteration depth is unknown without deeper analysis.
• Manual code review cannot cover every entry point in a large org consistently or at scale.

Rather than relying on manual review, the agent automatically scans the entire Salesforce Apex codebase, builds a full dependency graph, and uses AI to independently assess every transaction chain for SOQL, DML, and callout exposure. The process runs in three stages, entirely without manual initiation:

Stage 1 — Cleanup — previous results cleared

Old analysis run records and entry point records are deleted in bulk chunks before each new run, ensuring every analysis starts with zero data pressure and results always reflect the current state of the codebase.

Stage 2 — Graph build and structural scoring

The Salesforce Tooling API is used to fetch all Apex class, trigger, and Flow dependencies. A full adjacency map is built, async boundaries (Batch, Queueable, Schedulable, @future) are detected, and every transaction entry point is scored structurally — chain depth, chain size, transaction type, and parent callers.

Stage 3 — AI analysis — GPT-4o scores every entry point

For each entry point, risky method snippets and call graph edges are extracted from symbol tables and submitted to OpenAI GPT-4o. The AI counts SOQL, DML, and callout operations; identifies looped and recursive patterns; assigns a risk score of 0–100; and writes a plain-English explanation naming the specific classes and methods at risk. Results are written back to Salesforce automatically.

Example output — entry point risk assessment

Every transaction chain is scored against the hard Salesforce per-transaction resource caps. Async chains are assessed against the correct limit set for their transaction type.

The Governor Limit Risk Prediction Agent is an Agentic AI solution built natively on Salesforce, combining the Salesforce Tooling API, Apex automation, and OpenAI GPT-4o to autonomously scan an entire Apex codebase, build a full dependency graph, and assess every transaction chain for governor limit exposure — without any manual initiation.

Each capability is delivered through the following components:

• Automated Cleanup & Run Initialisation: Prior analysis run records and entry point records are deleted in bulk chunks before each new execution via an Apex batch process, ensuring every run starts from a clean state and results always reflect the current codebase. A single call to GovernorLimitCleanupBatch.run() triggers the entire pipeline end-to-end.
• Dependency Graph Build & Structural Scoring: The Salesforce Tooling API fetches all ApexClass, ApexTrigger, and Flow dependencies. An Apex service builds a full adjacency map, detects async transaction boundaries (Batch, Queueable, Schedulable, @future), and structurally scores every transaction entry point by chain depth, chain size, transaction type, and parent callers.
• Cross-Method Loop Detection: Call graph edges are extracted from Apex symbol tables across all classes in each chain. Apex services trace SOQL, DML, and callout operations that execute inside loops — even when the loop and the operation span different classes. Recursive methods are flagged and treated conservatively as looped patterns. Interface implementors are expanded to all known concrete classes so no risky implementor is silently excluded.
• Async Boundary Awareness: Rule-based Apex logic distinguishes six transaction types (Sync, Trigger, Future, Queueable, Batch, Scheduled) and applies the correct governor limit set to each. Async chains are scored against the 200-query SOQL limit; Sync and Trigger chains are scored against the 100-query limit. Breach percentages are calculated per applicable limit for each transaction type.
• AI Risk Scoring: For each entry point, risky method snippets and call graph edges are submitted to OpenAI GPT-4o via a Salesforce Named Credential. The AI counts SOQL, DML, and callout operations; identifies looped and recursive patterns; assigns a risk score of 0–100; classifies the transaction pattern (Read-Heavy, Write-Heavy, Integration, Fan-out, Deep-chain, or Mixed); and writes a plain-English explanation naming the specific classes and methods at risk. Results are written back automatically to native Salesforce custom objects.
• Native Salesforce Results Storage: All analysis output is persisted to two custom objects — GovernorLimitAnalysisRun__c (one record per run, tracking status and metadata) and GovernorLimitEntryPoint__c (one record per entry point, holding all risk scores and AI output). Results are immediately available in list views, dashboards, and reports with no external tooling required.

Architecture principle: Deterministic Apex guarantees accuracy and auditability for dependency graph construction, structural scoring, and limit threshold calculation; GPT-4o handles language, pattern recognition, and risk explanation; and the automated batch pipeline makes the system truly agentic — running the full org scan end-to-end on a single trigger, without manual intervention at any stage.

Full Org Scan — Every Entry Point Assessed in a Single Run

The agent scans the entire Apex codebase in one execution. Every trigger, sync class, batch, queueable, scheduled class, and @future method is treated as a separate transaction entry point and scored independently.

• All ApexClass, ApexTrigger, and Flow entry points identified and scored
• @future methods detected and scored as separate async entry points
• Each entry point scoped to its own transaction boundary — no cross-boundary confusion
• A single call to GovernorLimitCleanupBatch.run() triggers the entire pipeline

Async Boundary Awareness — Correct Limits Applied Per Transaction Type

The agent distinguishes six transaction types and applies the correct governor limit set to each. Async chains are not scored against sync limits — every entry point is assessed fairly against what Salesforce actually enforces.

• Transaction types: Sync, Trigger, Future, Queueable, Batch, Scheduled
• Async chains (Future, Batch, Queueable, Scheduled) scored against the 200-query SOQL limit
• Sync and Trigger chains scored against the 100-query SOQL limit
• Breach percentages calculated against the applicable limit for each transaction type

Cross-Method Loop Detection — Risks That Single-File Review Misses

The most dangerous governor limit patterns span multiple classes. The agent traces the full call graph to identify SOQL, DML, and callout operations that execute inside loops — even when the loop and the operation are in different classes.

• Call graph edges extracted from Apex symbol tables across all classes in the chain
• Looped SOQL, DML, and callout counts tracked separately from totals
• Recursive methods flagged and treated as looped — conservative worst-case assessment
• Interface implementors expanded to all known concrete classes — no risky implementor silently excluded

AI Risk Scoring — Scores Grounded in Actual Code Signals

GPT-4o analyses each entry point and returns a structured risk assessment calibrated to the actual patterns found in the code — not a generic heuristic score.

• Risk score 0–100 with calibration guidance (no loops = below 40; unbounded loops = above 75)
• Risk level: LOW / MEDIUM / HIGH derived from score
• Transaction pattern classified: Read-Heavy, Write-Heavy, Integration, Fan-out, Deep-chain, or Mixed
• Two-sentence plain-English explanation naming specific classes and methods at risk
• Breach percentages per limit: SOQL, DML, and callout — each capped at 100%

The Governor Limit Risk Prediction Agent delivers value across every level of the Salesforce development organisation — from individual developers to technical leadership and business operations.