Winter ’27 Release Architect Highlights: Security, Agentic Architecture, and Governance

The Winter ’27 Release retires legacy capabilities and introduces new platform features that can strengthen your security posture and open new ways to solve business needs. As your org’s architect, you need to make coordinated decisions about security, capacity, agentic architecture, and governance that apply to your environments. Use this guide to focus your Winter ’27 review on four areas: mandatory security enforcements, capacity and automation updates, agentic architecture, and governance and observability. Start by mitigating operational risk, then evaluate where new platform capabilities may help your current configurations scale and influence your architecture roadmap. Several Winter ’27 changes raise the security floor. Legacy authentication methods retire to close weak entry points, while refresh tokens now expire after inactivity so forgotten credentials can’t linger. External client apps expose less by default and replace connected apps, which require action to restrict user access. These changes can reduce security risk across your org, but integrations that still rely on a retired method may stop working if you don’t take action. Plan for refresh token inactivity expiration: Starting November 4, 2026, production refresh token idle time-to-live (TTL) expires after 30 days of inactivity, which…