Search, Integrations and AI Glossary · Workplace

ACL sync: Copying a source system's permissions into a search index, on a schedule or by events (Enterprise Search).
Admin consent: an administrator's approval of an app's or client's permissions on behalf of the whole tenant, required for tenant-wide scopes (Apps & Marketplaces).
Agent identity: a principal type for an AI agent, distinct from users and app registrations, that makes its actions attributable and revocable, as in Microsoft Entra Agent ID (AI Agents, Connectors & MCP).
Agent sponsor: the person accountable for an agent, recorded with its identity and asked to re-justify it (AI Agents, Connectors & MCP).
API controls: Google Workspace's per-app access levels (trusted, specific data, limited, blocked) and restricted services (Apps & Marketplaces).
App installation: one app installed into one workspace or tenant, with its own granted scopes and tokens (Apps & Marketplaces).
Autoreplay: Zapier's automatic replay of errored runs on paid plans (Integration Platforms & Workflow Builders).
CASA: the App Defense Alliance's Cloud Application Security Assessment, required annually by Google for apps using restricted scopes (Apps & Marketplaces).
Change notification: a Microsoft Graph delivery telling a subscriber a resource changed, basic (ID only) or rich (with encrypted data) (APIs, Events & Rate Limits).
Client ID Metadata Document: an HTTPS URL used as an OAuth client ID that points to the client's name and redirect URIs, the registration MCP prefers when a client isn't pre-registered (AI Agents, Connectors & MCP).
Connect: Atlassian's older app framework in which apps run on the developer's servers, being retired in favor of Forge (Apps & Marketplaces).
Connection (integration): a saved credential an integration platform holds to one external account, usually an employee's OAuth grant (Integration Platforms & Workflow Builders).
Connector data groups: Power Platform's Business, Non-business and Blocked classes; connectors in different groups can't be combined in one flow (Integration Platforms & Workflow Builders).
Copilot connector: Microsoft's connector (formerly Graph connector) that indexes or federates external content for Microsoft Search and Copilot (Enterprise Search).
Data access governance reports: SharePoint Advanced Management reports on permission state, broad sharing and sensitivity labels, used for oversharing remediation (AI Assistants Over Company Data).
Delta query: a Microsoft Graph request that returns only changes since a stored token (APIs, Events & Rate Limits).
Deny precedence: The rule that a deny entry in an ACL overrides any grant to the same person (Enterprise Search).
Document-level security: Restricting which indexed documents a query can return by the searcher's identity and groups (Enterprise Search).
Early binding: Applying permissions as a filter inside the search query, so counts, facets and pages are correct (Enterprise Search).
Embedded iPaaS: an integration platform a software vendor ships inside its own product under its own brand (Integration Platforms & Workflow Builders).
External group: A group from a non-directory source synced as its own object and referenced by item ACLs instead of being expanded (Enterprise Search).
Federated search: Querying each source's own search API at query time and merging the results, with no index of the content (Enterprise Search).
Forge: Atlassian's hosted serverless app platform, with scopes and egress declared in a manifest (Apps & Marketplaces).
Grounding: retrieving tenant content as the asking user and giving it to the model to answer from, with citations (AI Assistants Over Company Data).
Group intersection: An ACL entry that grants access only to people in all of several groups at once (Enterprise Search).
Identity mapping: Linking each source system's user ids to one directory identity so ACLs can be evaluated (Enterprise Search).
Indexed search: Copying content and permissions into a central index ahead of queries (Enterprise Search).
iPaaS: integration platform as a service, such as Zapier, Make, Workato or Power Automate (Integration Platforms & Workflow Builders).
Late binding: Checking permissions on results after the query runs, a costlier fallback for rules a filter can't express (Enterprise Search).
Lifecycle notification: a Graph warning that a subscription or its token is expiring or that an admin revoked the app's access (APIs, Events & Rate Limits).
MCP server: a vendor-hosted endpoint that lets outside AI clients act in a workspace with the user's permissions (AI Agents, Connectors & MCP).
Model Context Protocol (MCP): an open protocol for connecting model-driven clients to servers that expose tools, resources and prompts (AI Agents, Connectors & MCP).
Oversharing: Content whose permissions are broader than intended, exposed when search or AI makes it findable (Enterprise Search).
Permission trimming: Showing a searcher only results the source system would let them open (Enterprise Search).
Points-based rate limit: Atlassian's hourly quota in which each request costs points by the objects it touches (APIs, Events & Rate Limits).
Polling trigger: an integration trigger that asks the source for new records on a schedule (Integration Platforms & Workflow Builders).
Power Platform request: the unit Power Automate meters per user or flow per 24 hours, counting every action including failures and retries (Integration Platforms & Workflow Builders).
Principal set: The searcher's identity, groups and applicable everyone principals, computed once per query and used as the filter (Enterprise Search).
Prompt injection via shared content: instructions planted in channels, documents, issues or email that an agent reads and follows (AI Agents, Connectors & MCP).
Reciprocal rank fusion: Combining ranked lists by summing 1/(k + rank) per document, used to merge keyword and vector results (Enterprise Search).
Restricted Content Discovery: A SharePoint site setting that keeps content out of org-wide search and Copilot without changing permissions (Enterprise Search).
Revenue share: the marketplace operator's cut of paid app sales it bills, such as Atlassian's Forge and Connect rates (Apps & Marketplaces).
Runs on Atlassian: Atlassian's badge for Forge apps that use only Atlassian-hosted compute and storage, match residency and let admins control egress (Apps & Marketplaces).
Semantic index: Microsoft's organization-wide index over SharePoint and connector content that grounds Copilot, trimmed to each user's access (Enterprise Search).
Socket Mode: Slack's delivery of events and interactions over a WebSocket instead of a public Request URL (APIs, Events & Rate Limits).
Step-up authorization: requesting broader OAuth scopes only when a privileged tool is first used, after an insufficient_scope challenge (AI Agents, Connectors & MCP).
Teamwork Graph: Atlassian's graph of work objects from its own and connected apps, fed by Forge connectors with permissions (Enterprise Search).
Token passthrough: an MCP server forwarding a client's token to an upstream API, forbidden by the specification (AI Agents, Connectors & MCP).
Unified API: one schema per software category (HR, CRM, ATS) over many vendors' APIs, such as Merge (Integration Platforms & Workflow Builders).
Unlisted app: a Slack app distributed commercially outside the Marketplace, subject to lower history limits since May 2025 for new installs and since March 3, 2026 for existing ones (APIs, Events & Rate Limits).
Watch channel: Google Drive's push subscription on a file or the changes feed, expiring in at most a day or a week (APIs, Events & Rate Limits).
XPIA: cross-prompt injection attack, Microsoft's term for instructions arriving through retrieved content, flagged in Copilot audit records (AI Agents, Connectors & MCP).