Set up MIC AI

This guide describes how an administrator installs and configures MIC AI (the AIMI package) on top of Medical Information Cloud.

AIMI is unnamespaced (the MAI_ prefix is a naming convention, not a namespace) and installs as an unmanaged metadata deployment on top of the mvn-namespaced Medical Information Cloud core, which it depends on.

The AIMI Tier 1 Agent is not delivered ready-made. The package ships subagents, prompt templates, flows, and connection-asset templates in the Agentforce Builder Asset Library; an administrator assembles and activates the orchestration agent in your org. Follow the steps below in order.

Prerequisites

Before you configure MIC AI, confirm the following:

• Medical Information Cloud is installed in the org.
• The org is Einstein/Agentforce enabled, with Prompt Builder and Agentforce (Agent) available.
• Documents are published in Mavens Content (MCM) so they can be recommended. Document search runs through the same engine as manual Content Search.
• You can edit the Agentforce connection assets used by AIMI (External Credential, Named Credential, and External Client App).
• You have a valid email address you can access for External Client App verification codes.

Step 1 - Assign permission sets

AIMI ships four permission sets. Assign them according to who needs each capability.

Permission set	Assign to	Grants
MAI_AIMI_User	Medical Information specialists	Read/edit access to MAI_AIMI_Response_Log__c records and the AIMI Recommends workflow
MAI_AIMI_Content_Access	Medical Information specialists	Access to documents surfaced as suggested content
MAI_AIMI_Agent_PS	The AIMI agent integration user	Field-level access the agent needs to create and update response logs
MAI_Run_AIMI_Prompt	Specialists who use the Ask AIMI prompt component	Access to run AIMI prompt options on demand

note

The AIMI Recommends panel is gated by the MAI_Agentic_Fulfillment_Access custom permission, which the MAI_AIMI_User permission set already grants, so assigning that permission set is sufficient. Grant the custom permission separately only for custom profiles that do not use MAI_AIMI_User.

Also assign MAI_AIMI_User to at least one administrator who will verify the setup. You assign MAI_AIMI_Agent_PS to the agent integration user in Step 4 after you create the Tier 1 Agent.

Assign the AIMI permission set to the Automated Process users

When an inbound email is ingested through Email-to-Case and the resulting Interaction meets the minimum requirements (for example, product and country are set), the AIMI Tier 1 Agent is triggered automatically. That processing runs in the context of the org's Automated Process user, which by default holds none of the AIMI permissions, so the run fails unless that user has the AIMI permission set.

Automated Process users cannot be assigned a permission set through the Setup UI, so assign it with the following anonymous Apex. Run it once from Developer Console → Debug → Open Execute Anonymous Window (or with sf apex run):

// The permission set assigned to the Automated Process users. Change this to a
// more restrictive permission set if you want to grant the automated users
// fewer permissions than MAI_AIMI_User.
String permissionSetName = 'MAI_AIMI_User';

List<User> autoUsers = [SELECT Id, Name, UserType FROM User WHERE UserType = 'AutomatedProcess' LIMIT 5];
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = :permissionSetName LIMIT 1];

List<PermissionSetAssignment> psaList = new List<PermissionSetAssignment>();
for (User usr : autoUsers) {
    PermissionSetAssignment psa = new PermissionSetAssignment();
    psa.AssigneeId = usr.Id;
    psa.PermissionSetId = ps.Id;
    psaList.add(psa);
}
insert psaList;

note

MAI_AIMI_User grants the full AIMI capability. If you prefer to give the Automated Process users only what the automated run needs, set permissionSetName to a more limited permission set, one that still grants access to the AIMI objects and the automated fulfillment logic.

Step 2 - Connect AIMI to your Agentforce agent

AIMI calls your Agentforce agent through Salesforce callout infrastructure. The package ships template connection assets; you must configure them with org-specific values before recommendations can run.

warning

The connection assets ship as templates. You must supply your org-specific My Domain URL, OAuth credentials, and integration user before AIMI can call the agent. Without a working connection, no recommendations are generated.

Configure the External Client App

1. From Setup, enter External Client App in Quick Find and select External Client Apps Manager.
2. Open the app named AIMI Agent ECA (AIMI_Agent_ECA).
3. On the Settings tab, click Edit.
4. Set Contact Email to a valid address you can access (Salesforce sends verification codes here).
5. Under OAuth Settings, select Enable OAuth.
6. For Callback URL, enter your org's My Domain URL. Find it under Setup → My Domain (for example, https://your-org.my.salesforce.com).
7. Under Selected OAuth Scopes, add:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
   • Access chatbot services (chatbot_api)
   • Access the Salesforce API Platform (sfap_api)
8. Under Additional OAuth Settings, select:
   • Enable Client Credentials Flow
   • Issue JWT-based access tokens for named users
9. Deselect:
   • Require secret for Web Server Flow
   • Require secret for Refresh Token Flow
   • Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows
10. Save the app.
11. Open the Policies tab and click Edit.
12. Under OAuth Flows and External Client App Enhancements, check Enable Client Credentials Flow.
13. Set Run As (Username) to a user with at least API Only access (typically an admin or integration user).
14. Under App Authorization:
    • Refresh Token Policy, Refresh token is valid until revoked
    • IP Relaxation, Relax IP restrictions
15. Save the changes.

Configure the Named Credential and external credential

1. Return to AIMI Agent ECA on the Settings tab.

2. Under OAuth Settings, click Consumer Key and Secret and complete the email verification to reveal the Client Id and Client Secret. Keep this tab open.

3. In a separate browser tab, open Setup → Named Credentials.

4. Select the External Auth Identity Providers tab and open AIMI EAuth IDP (MAI_AIMI_EAuth_IDP).

5. Click Edit, paste the Client Id and Client Secret from the External Client App, and set the Token Endpoint URL to:

   https://{YOUR_MY_DOMAIN}/services/oauth2/token

   Replace {YOUR_MY_DOMAIN} with your org's My Domain host (the same host you used for the callback URL, without a trailing path).

6. Save the identity provider.

7. Open the External Credentials tab and open AIMI External Cred (MAI_AIMI_External_Cred).

8. Scroll to Principals and confirm a principal exists with:

   • Parameter Name, AIMI EC Access
   • Sequence Number, 1
   • Identity Type, Named Principal

9. Confirm the MAI_AIMI_Agent_PS permission set grants access to this external credential principal (you assign that permission set to the integration user in Step 4).

The Named Credential MAI_AIMI_Named_Cred is pre-linked to these assets in the package. After the External Client App, identity provider, and external credential are configured, AIMI can authenticate callouts to Agentforce in this org.

Step 3 - Create the AIMI Tier 1 Agent

The package publishes four subagents in the Agentforce Builder Asset Library. You assemble them into the AIMI Tier 1 Agent orchestration agent using Agentforce Studio.

1. Open Agentforce Studio (Agent Builder).
2. Click New Agent.
3. Enter the agent name AIMI : Tier 1 Agent.
4. Select Agentforce Service Agent as the template type and let the setup wizard finish.
5. When setup completes, switch the builder from Canvas to Script mode.
6. Copy the script from AIMI Tier 1 Agent Builder script and paste it into Script mode.
7. Update the default_agent_user value in the script to match the Einstein Service Agent user created for this agent in your org (see Step 4).
8. When prompted to select an Agent User, choose Einstein ServiceAgent User (or the Einstein service agent user record created for this agent).
9. Click Commit, then Activate the agent.
10. Copy the agent's Id from Agent Builder; you need it when you configure prompt options in Step 5.

note

The script wires the four packaged subagents, Request Management, Product Quality Complaint Management, Adverse Event Recommendation, and Interaction Management, into a single topic-selector orchestration agent. Subagent action API names (MAI_AIMI_Agent_Get_Interaction_Details, MAI_Interaction_Product_And_Question, and so on) must match the flows and prompt templates deployed with AIMI.

Step 4 - Configure the agent integration user

After the Tier 1 Agent is created, configure the Einstein service agent user so it can run AIMI flows and prompts.

Assign permission sets

1. From Setup, open Users.
2. Search for the user created for the Einstein service agent (typically named Einstein ServiceAgent User or similar).
3. Open the user record and assign the MAI_AIMI_Agent_PS permission set.
4. Confirm your setup administrator also has MAI_AIMI_User (assigned in Step 1).

Add the agent user to the AIMI public group

1. From Setup, open Public Groups.
2. Open AIMI Public Group.
3. Edit the group and add the Einstein service agent user as a member.
4. Save the group.

Step 5 - Activate prompt templates and configure prompt options

Both AIMI experiences read their prompts from records of the MAI_AIMI_Prompt_Option__mdt custom metadata type. Before Agentic Fulfillment can run, activate the GenAI prompt templates and link prompt options to your Tier 1 Agent.

Activate prompt templates

1. Assign yourself (or your setup user) the Prompt Template Manager permission set so you can activate templates in Prompt Builder.

2. From Setup, open Prompt Builder.

3. Activate these prompt templates:

   Prompt template (label)	API name
   Interaction: Adverse Event Recommendation	MAI_Interaction_Adverse_Event_Recommendation
   Interaction: Product And Question	MAI_Interaction_Product_And_Question
   Interaction: Product Complaint Recommendation	MAI_Interaction_Product_Complaint_Recommendation
   Interaction: Summary	MAI_Interaction_Summary
   AIMI Response Log: Suggest Category	MAI_AIMI_Response_Log_Suggest_Category

   note

   The package also ships MAI_Request_Suggest_Category, which is superseded by MAI_AIMI_Response_Log_Suggest_Category for category suggestions on response logs. Activate MAI_AIMI_Response_Log_Suggest_Category for Agentic Fulfillment.

Configure Agent-type prompt options

For Agentic Fulfillment, the Agentforce agent runs MAI_AIMI_Prompt_Option__mdt records marked MAI_Config_Type__c = Agent and MAI_Is_Active__c = true, in MAI_Sort_Order__c order. Prompts for the Ask AIMI component are covered in Use Ask AIMI prompts.

1. From Setup, locate the AIMI Prompt Option custom metadata records (MAI_AIMI_Prompt_Option__mdt).
2. For each Agent-type record you want to enable, set MAI_Is_Active__c to active and populate MAI_Agent_Id__c with the Tier 1 Agent Id you copied in Step 3.
3. Review MAI_Sort_Order__c so use cases run in the order your program expects (for example: Interaction summary, then Request product/question, then category, then PQC, then AE).

Fields on MAI_AIMI_Prompt_Option__mdt that drive the Agentforce agent (Agent-type records):

Field	Purpose
MAI_Config_Type__c	Set to Agent for prompts the Agentforce agent runs automatically
MAI_Is_Active__c	Enables or disables the option (the agent runs only active Agent records)
MAI_Agent_Id__c	The Id of the Agentforce agent that handles the use case
MAI_User_Message__c	The message sent to the agent for this use case
MAI_Prompt_Developer_Name__c	The GenAI prompt template the use case is backed by
MAI_SObject_Name__c	The object the prompt runs against (typically Case)
MAI_Sort_Order__c	Controls the order use cases run in

The default active Agent-type options map to the AIMI recommendation types:

Prompt option (label)	Prompt template	Recommendation
Summarize Interaction	MAI_Interaction_Summary	Interaction Summary
Recommend Product and Question	MAI_Interaction_Product_And_Question	Request
Recommend Category and Sub-Category	MAI_AIMI_Response_Log_Suggest_Category	Request category
Recommend Product Quality Complaint	MAI_Interaction_Product_Complaint_Recommendation	PQC
Recommend Adverse Event	MAI_Interaction_AE_Recommendation	Adverse Event

note

The custom metadata records that configure these options are delivered as setup data (deployed as unmanaged metadata), so you can tune MAI_Is_Active__c and MAI_Sort_Order__c per org.

Step 6 - Add MIC AI to the Medical Information console

1. Add the AIMI Recommends panel to the utility bar of your Medical Information Cloud console app. The packaged Medical Information Cloud UtilityBar FlexiPage already includes the maiAgenticFulfillmentWrapper utility item; if you use a custom app, add that utility item (maiAgenticFulfillmentWrapper, shown as Agentic Fulfillment in App Builder) to its utility bar.
2. Add the Agentic Fulfillment Helper (maiAgenticFulfillmentHelper) to the Interaction (Case) record page. This component is required for AIMI Recommends: it lets the panel open on its own when an Interaction has recommendations awaiting review, and it opens the originating email in a console subtab when a specialist uses Check Source. The component is not on a packaged FlexiPage, an administrator places it on the Interaction record page in the Lightning App Builder. It is an invisible helper that renders nothing, so its position on the page does not matter as long as it is present.
3. (Optional) Add the AIMI Prompt Component (maiAimiPromptComponent) to the Interaction record page so specialists can run Ask AIMI prompts on demand. See Use Ask AIMI prompts for the component placement, permission set, and prompt-option setup.
4. (Optional) Add the AIMI Response Log tab and the AIMI_Response_Log_Record_Page record page if you want specialists to open response logs directly.

Step 7 - Verify the setup

1. Send a medical information request email to the Email-to-Case service address configured for your org.
2. Confirm an Interaction is created and, after a short delay, that MAI_AIMI_Response_Log__c records are created for it.
3. Open the Interaction in the console and confirm the AIMI Recommends panel shows the recommendations. (If the panel does not open on its own, confirm the Agentic Fulfillment Helper is on the Interaction record page.)

note

The AIMI Tier 1 Agent runs on an email-origin Interaction once it has a country set, on creation, or when the country is later populated or changed (any country, not a single configured one). Populate the country if it is not set automatically, so document recommendations can run and the suspect product can be resolved for adverse-event and complaint recommendations.

Step 8 - Review the AIMI Insights example reports

AIMI ships a packaged AIMI Insights report folder as a set of example reports, a starting point for monitoring MIC AI adoption, recommendation quality, and adverse-event/complaint capture, not a validated report set. The folder is shared with the whole organization at View access. After verifying the setup, open the AIMI Insights folder on the Reports tab to confirm the reports are present, then adapt or replace them to fit how your team reports on agent activity.