Glossary

A request for something you can't do on your own — a higher budget, reading a conversation, viewing the portal as someone. Someone other than the requester decides.

Where admins manage people, models, budgets, tools and the audit log. You only see the screens your role allows.

An assistant with its own instructions, knowledge, tools and default model. Every chat runs through one — plain chat is an agent that used no tools.

The cycle an agent repeats inside one turn: call the model, run the tools it asks for, read the results, and call the model again until it can answer.

The point, 80% by default, where a budget alert is raised. Nothing is refused.

AWS's model service, running in your account's region. The portal's models and embeddings come from here, always through LiteLLM.

Your yes or no before an agent changes something in a connected app. The turn pauses until you decide.

A file an agent creates for you during a chat — a document, spreadsheet, slide deck or small app — that you can open, download and share.

The record of who did what: every model call with its cost and department, plus admin changes and approvals.

The monthly amount a level may spend on models — organisation default, department or person. The most specific level that is set wins.

Permission to do one kind of thing, such as setting budgets or reading the audit log. Roles are the only way to get one.

A numbered mark in an answer that links back to the passage it came from. Sources are saved with the answer and still open after the document changes.

A question the agent asks you in the middle of a turn, with suggested answers and a box to type your own. Answering continues the same turn.

An outside app, such as a ticketing or CRM system, that agents can use on your behalf after you sign in to it under Settings › Connected apps.

A role an admin creates or edits, held directly or through a group. Four capabilities, including billing, can never be put in one.

If any deny rule matches a person, the resource is hidden from them — even when an allow rule also matches, and even for its owner. Hidden looks exactly like missing.

The bucket that pays: it owns a budget, limits and which models its people may use. Everyone belongs to exactly one.

The built-in department for everyone not assigned to another one, so every request always has a department to bill.

A set of people used to give roles and to name in sharing rules. A person can be in many groups; a group never holds money.

A safety check on what goes into and comes out of a model — for example blocking harmful content or sensitive data. Admins set it for the organisation.

A collection of documents agents can search and cite. Files are uploaded or synced from SharePoint, and each knowledge base has its own sharing rules.

The gateway every model call passes through. It routes to Bedrock, applies each department's key and budget, and records the cost of every call.

Model Context Protocol, the standard way an agent talks to an outside app. The portal reaches every connected app through one MCP gateway inside your AWS account.

Facts the portal keeps about you between conversations, such as your role or preferences. You can see and delete them under Settings › Memory; only you can read them.

One request to a model. A single turn can make many, and each one is logged with its own cost.

A key for a model provider outside Bedrock, pasted by a person or a department. Calls still go through the portal's gateway, so they are billed and audited like any other.

Your company's space in the portal. Each deployment runs one organisation, inside your own AWS account.

A short section of a document, cut along its headings and stored with an embedding. Search returns passages, not whole files.

A saved message you reuse from the prompt library instead of typing it again.

A cap on requests or tokens per minute. Unlike a spent budget it clears by itself, so the agent waits and retries a few times before giving up.

Reading a document again, for example at a deeper reading level. Pages a model already read are kept, so you never pay twice for the same page.

How deeply the portal reads a PDF or image: Text (text layer and OCR, no model), Text + figures (pictures described), or Full rewrite (a model writes out every page). Deeper costs more.

Anything shared in the portal: agents, skills, prompts, knowledge bases, connected apps and artifacts. Resources belong to the organisation, never to a department.

A bundle of capabilities. Everyone has one built-in role — Org Owner, Org Admin or Org User — and groups can add custom roles on top.

A connected-app setting that skips the approval prompt for each action. It never bypasses permissions, sign-in scope, policy or the audit log.

The standard your identity provider uses to create, update and remove portal accounts automatically, so people who leave lose access.

Finding passages by meaning rather than exact words, using embeddings. It runs alongside keyword and document-code search, which are always on and free.

Your equal part of your department's budget: the budget divided by the active people billed to it, rounded down to the cent.

Signing in once with your company account, such as Entra ID or Okta. The portal never sees your password.

A reusable set of instructions an agent loads when a task calls for it, such as writing a report in your company's format.

The point, 100% by default, where new model calls are refused until the budget resets next month.

How long the model may think before answering. More effort can help with hard questions, but it takes longer and costs more.

A short, safe description of what the agent is considering, shown while it works. The model's raw reasoning is never shown.

Something an agent can do besides writing text: search knowledge, search the web, read a file, create an artifact, or act in a connected app.

Everything between sending a message and getting the answer: checks, model calls, tool use, pauses for you, and the reply. It keeps running if you close the tab.

Seeing the portal exactly as another person sees it, to reproduce a problem. It needs its own capability and is recorded in the audit log.

A gateway key issued per department, so each model call is limited and billed to the right department. People never handle it.

A resource's own sharing rules: who can find and use it, by department, group or person. Seeing a resource never grants extra permissions.