The refill topic's "Get Upcoming Appointments" action sometimes returns appointments booked at a sister clinic across town instead of the clinic the owner actually called. Which change forces the action to always scope to the correct clinic, rather than trusting the reasoning engine to pick right?

Deterministic behaviour in Agentforce comes from configuration that constrains data before the reasoning engine ever sees it, and a filter on an action's underlying query is exactly that: it narrows the record set to rows matching the caller's ClinicId, so the action physically cannot return another clinic's appointments regardless of how the model reasons about the request. An instruction telling the agent to check the clinic is the closest-looking trap, because it sounds like the same fix, but instructions are language guidance the model can misapply or skip under ambiguous phrasing, so they reduce the error rate without eliminating it. Editing the classification description does nothing here because classification only decides which topic handles the utterance, not which records an already-selected action's query returns. Adding more example utterances tunes topic matching for similar reasons and has no effect on data scoping inside an action. The exam-relevant distinction: guardrails and instructions shape what the agent says and does at the language layer, while filters and variables constrain the data layer, and only the data layer is truly deterministic.