# Search, Integrations and AI Glossary

> 52 terms from the Workplace & Collaboration book's Search, Integrations and AI part, each defined in a line and linked to the chapter that explains it.

- **ACL sync:** Copying a source system's permissions into a search index, on a schedule or by events ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#acl-sync-and-its-latency)).
- **Admin consent:** an administrator's approval of an app's or client's permissions on behalf of the whole tenant, required for tenant-wide scopes ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#admin-approval-and-consent)).
- **Agent identity:** a principal type for an AI agent, distinct from users and app registrations, that makes its actions attributable and revocable, as in Microsoft Entra Agent ID ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#agent-identity)).
- **Agent sponsor:** the person accountable for an agent, recorded with its identity and asked to re-justify it ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#agent-identity)).
- **API controls:** Google Workspace's per-app access levels (trusted, specific data, limited, blocked) and restricted services ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#admin-approval-and-consent)).
- **App installation:** one app installed into one workspace or tenant, with its own granted scopes and tokens ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#what-an-app-is)).
- **Autoreplay:** Zapier's automatic replay of errored runs on paid plans ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#failure-handling)).
- **CASA:** the App Defense Alliance's Cloud Application Security Assessment, required annually by Google for apps using restricted scopes ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#marketplace-review)).
- **Change notification:** a Microsoft Graph delivery telling a subscriber a resource changed, basic (ID only) or rich (with encrypted data) ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#microsoft-graph-change-notifications)).
- **Client ID Metadata Document:** an HTTPS URL used as an OAuth client ID that points to the client's name and redirect URIs, the registration MCP prefers when a client isn't pre-registered ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#mcp-authorization)).
- **Connect:** Atlassian's older app framework in which apps run on the developer's servers, being retired in favor of Forge ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#hosting-forge-and-the-connect-retirement)).
- **Connection (integration):** a saved credential an integration platform holds to one external account, usually an employee's OAuth grant ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#credential-custody)).
- **Connector data groups:** Power Platform's Business, Non-business and Blocked classes; connectors in different groups can't be combined in one flow ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#governance)).
- **Copilot connector:** Microsoft's connector (formerly Graph connector) that indexes or federates external content for Microsoft Search and Copilot ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#how-the-platforms-do-it)).
- **Data access governance reports:** SharePoint Advanced Management reports on permission state, broad sharing and sensitivity labels, used for oversharing remediation ([AI Assistants Over Company Data](https://www.syntaqx.com/books/workplace-and-collaboration/ai-assistants#oversharing)).
- **Delta query:** a Microsoft Graph request that returns only changes since a stored token ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#request-apis)).
- **Deny precedence:** The rule that a deny entry in an ACL overrides any grant to the same person ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#the-acl-model)).
- **Document-level security:** Restricting which indexed documents a query can return by the searcher's identity and groups ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#permission-trimming)).
- **Early binding:** Applying permissions as a filter inside the search query, so counts, facets and pages are correct ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#permission-trimming)).
- **Embedded iPaaS:** an integration platform a software vendor ships inside its own product under its own brand ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#unified-apis-and-embedded-integration)).
- **External group:** A group from a non-directory source synced as its own object and referenced by item ACLs instead of being expanded ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#the-acl-model)).
- **Federated search:** Querying each source's own search API at query time and merging the results, with no index of the content ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#index-or-federate)).
- **Forge:** Atlassian's hosted serverless app platform, with scopes and egress declared in a manifest ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#hosting-forge-and-the-connect-retirement)).
- **Grounding:** retrieving tenant content as the asking user and giving it to the model to answer from, with citations ([AI Assistants Over Company Data](https://www.syntaqx.com/books/workplace-and-collaboration/ai-assistants#how-grounding-works)).
- **Group intersection:** An ACL entry that grants access only to people in all of several groups at once ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#the-acl-model)).
- **Identity mapping:** Linking each source system's user ids to one directory identity so ACLs can be evaluated ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#identity-mapping)).
- **Indexed search:** Copying content and permissions into a central index ahead of queries ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#index-or-federate)).
- **iPaaS:** integration platform as a service, such as Zapier, Make, Workato or Power Automate ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#how-the-platforms-do-it)).
- **Late binding:** Checking permissions on results after the query runs, a costlier fallback for rules a filter can't express ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#permission-trimming)).
- **Lifecycle notification:** a Graph warning that a subscription or its token is expiring or that an admin revoked the app's access ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#microsoft-graph-change-notifications)).
- **MCP server:** a vendor-hosted endpoint that lets outside AI clients act in a workspace with the user's permissions ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#how-the-platforms-do-it)).
- **Model Context Protocol (MCP):** an open protocol for connecting model-driven clients to servers that expose tools, resources and prompts ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#the-model-context-protocol)).
- **Oversharing:** Content whose permissions are broader than intended, exposed when search or AI makes it findable ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#oversharing-search-makes-permissions-visible)).
- **Permission trimming:** Showing a searcher only results the source system would let them open ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#permission-trimming)).
- **Points-based rate limit:** Atlassian's hourly quota in which each request costs points by the objects it touches ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#rate-limits)).
- **Polling trigger:** an integration trigger that asks the source for new records on a schedule ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#triggers-and-polling)).
- **Power Platform request:** the unit Power Automate meters per user or flow per 24 hours, counting every action including failures and retries ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#billing-units)).
- **Principal set:** The searcher's identity, groups and applicable everyone principals, computed once per query and used as the filter ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#how-to-build-it)).
- **Prompt injection via shared content:** instructions planted in channels, documents, issues or email that an agent reads and follows ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#prompt-injection-through-shared-content)).
- **Reciprocal rank fusion:** Combining ranked lists by summing 1/(k + rank) per document, used to merge keyword and vector results ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#ranking-with-organizational-signals)).
- **Restricted Content Discovery:** A SharePoint site setting that keeps content out of org-wide search and Copilot without changing permissions ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#oversharing-search-makes-permissions-visible)).
- **Revenue share:** the marketplace operator's cut of paid app sales it bills, such as Atlassian's Forge and Connect rates ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#revenue-share-and-billing)).
- **Runs on Atlassian:** Atlassian's badge for Forge apps that use only Atlassian-hosted compute and storage, match residency and let admins control egress ([Apps & Marketplaces](https://www.syntaqx.com/books/workplace-and-collaboration/apps-and-marketplaces#hosting-forge-and-the-connect-retirement)).
- **Semantic index:** Microsoft's organization-wide index over SharePoint and connector content that grounds Copilot, trimmed to each user's access ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#oversharing-search-makes-permissions-visible)).
- **Socket Mode:** Slack's delivery of events and interactions over a WebSocket instead of a public Request URL ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#slack-events-and-socket-mode)).
- **Step-up authorization:** requesting broader OAuth scopes only when a privileged tool is first used, after an `insufficient_scope` challenge ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#mcp-authorization)).
- **Teamwork Graph:** Atlassian's graph of work objects from its own and connected apps, fed by Forge connectors with permissions ([Enterprise Search](https://www.syntaqx.com/books/workplace-and-collaboration/enterprise-search#how-the-platforms-do-it)).
- **Token passthrough:** an MCP server forwarding a client's token to an upstream API, forbidden by the specification ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#mcp-authorization)).
- **Unified API:** one schema per software category (HR, CRM, ATS) over many vendors' APIs, such as Merge ([Integration Platforms & Workflow Builders](https://www.syntaqx.com/books/workplace-and-collaboration/integration-platforms#unified-apis-and-embedded-integration)).
- **Unlisted app:** a Slack app distributed commercially outside the Marketplace, subject to lower history limits since May 2025 for new installs and since March 3, 2026 for existing ones ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#the-2025-slack-changes)).
- **Watch channel:** Google Drive's push subscription on a file or the changes feed, expiring in at most a day or a week ([APIs, Events & Rate Limits](https://www.syntaqx.com/books/workplace-and-collaboration/apis-webhooks-and-rate-limits#google-workspace-push)).
- **XPIA:** cross-prompt injection attack, Microsoft's term for instructions arriving through retrieved content, flagged in Copilot audit records ([AI Agents, Connectors & MCP](https://www.syntaqx.com/books/workplace-and-collaboration/ai-agents-and-mcp#prompt-injection-through-shared-content)).

---

Canonical URL: https://www.syntaqx.com/books/workplace-and-collaboration/glossary/search-integrations-and-ai