Tutorial
How to create an agent connected to Salesforce and Telegram
You do not build this agent in a form. You describe the job to AgentFather — a built-in agent whose job is making other agents — and it picks the archetype, adds the CRM tools and walks you through the sign-in. Then you ask your pipeline questions from your phone.
Eight minutes, including the agent being designed by another agent. Written reference below.
An agent builds the agent
The build starts with AgentFather, a built-in agent whose job is creating other agents. It knows what the platform can do, so instead of choosing an archetype and a tool list yourself, you describe the job and it proposes the setup.
In the video that conversation is short. Create an agent called Brian. What is Brian for? Sales, for a generators company. How much autonomy? "Brian can do the research and prepare the drafts, and then I will do the final approval." That last sentence is the important one — the approval boundary gets decided in plain language, at the start, before anything is connected.
AgentFather then looks at which models are available and which built-in professions fit, and comes back with a recommendation: the sales outreach archetype, with the Salesforce CRM tools added.
Two layers of authentication
Connecting Salesforce clears two separate gates, and the split is deliberate:
- Your own deployment first. An authentication page opens on your Olano deployment, secured with a short PIN shown in the chat. This proves the request came from you and not from something the agent read somewhere.
- Salesforce second. You continue to Salesforce, log in as yourself, and approve access. The window closes, and the first page reports the connection is finished.
Worth noting what the agent never handles: your Salesforce password, and the resulting tokens. Those live in the encrypted vault on your deployment.
One practical check while you are here — the agent inherits the permissions of the Salesforce user who authorised the connection. If you want it limited to certain objects or records, use a Salesforce user whose profile is already restricted. Permissions belong in the system that enforces them, not in an instruction to the agent.
Restart, then look at what you got
AgentFather restarts the new agent so the connection takes effect. Then open it from the agents list. You get a description, and a system prompt you can edit — which is where you add the detail AgentFather could not know: what your company sells, how you qualify, the words your team actually uses.
Asking the CRM questions
Start with the question you would have opened a report to answer: "What sales opportunities are documented in Salesforce right now?" The agent queries the CRM and lists them.
Then the one that shows what an agent adds over a search box: "Can you create a chart of the number of accounts we have per country?" It pulls the accounts, reads the billing country on each, and renders a chart. Nothing was installed to do that and no report was configured — it fetched the data and drew the answer.
This all works on a phone, though a table is easier to read on a desktop.
Why it keeps working when you close the laptop
The deployment runs in your own private cloud environment, not shared with other customers, and it runs continuously. Practically, that means the agent is not a program on your machine: shut your computer, message it from your phone, and it answers, because it was never running locally in the first place.
Connecting Telegram
Ask the agent directly: "I want to connect you to Telegram, can you help me out with that?" It opens a magic link and explains what it needs — a bot token from @BotFather.
Here is the detail worth repeating, because it is the whole design: the bot token is never sent to the model. The magic-link interface is served from your own deployment and writes the token directly into your encrypted vault. It does not leave your box.
Finish setup, the agent restarts, and it is on Telegram.
The CRM in your pocket
Message the bot and ask what data is in Salesforce. You see which functions it called — the tool calls are shown, not hidden — and then a summary: accounts, contacts, leads, opportunities, and the value attached to them.
Then open History back in the dashboard. The Telegram conversation is there, labelled as Telegram, alongside the desktop ones. You can continue the same thread from whichever device you are holding.
Where it goes from here
The obvious next step is scheduled work: a Monday pipeline summary, a nudge for opportunities gone quiet, a month-end report drafted for review. After that most teams want a second agent rather than a bigger one — a research agent the sales agent can ask about a company before a call. That shape is in the team tutorial.
If you want the simpler version of this loop first, the Notion tutorial uses the same connection pattern with lower stakes.
Related
Notion + Telegram in five minutes
The same connection pattern with lower stakes — a good first build.
A team of agents working together
When one agent should become several, and how they delegate.
AI CRM and sales assistant
The productised version: lead capture, qualification, approval-gated follow-ups.
Approvals and trust
Trust levels 0-4 and how the approval queue works.
FAQ
What is AgentFather?
A built-in agent whose job is creating other agents. It knows the platform's features, so you describe what you want the new agent to do and it asks follow-up questions, reviews the available models and built-in professions, and recommends an archetype and tool set — then sets it up and restarts it for you.
Why are there two authentication steps for Salesforce?
The first is on your own deployment, secured with a short PIN shown in the chat, which confirms the request came from you. The second is Salesforce's own login and approval. Splitting them means your password and the resulting tokens are handled by your deployment and Salesforce, never by the agent.
Can the agent see all of our Salesforce data?
It inherits the permissions of the Salesforce user who authorised the connection. To limit it to certain objects or records, authorise with a Salesforce user whose profile is already restricted — enforcing access in Salesforce is reliable in a way that instructing the agent is not.
Is my Telegram bot token sent to the AI model?
No. The magic-link interface is served from your own deployment and writes the token directly into your encrypted vault. It is never passed to the model and never leaves your environment.
Can it make charts from CRM data?
Yes. Asking for a chart of accounts per country, for example, has the agent query the accounts, read the billing country on each and render the chart. Nothing needs to be installed and no report needs configuring.
Does it keep working when my computer is off?
Yes. The deployment runs in your own private cloud environment, not shared with other customers, and runs continuously — so the agent answers a message from your phone whether or not your computer is on.
Put this on your own pipeline
Salesforce is one of 75+ built-in integrations. Start a deployment, describe the job to AgentFather, and have the agent built for you.