Thuật ngữ

Where admins manage people, models, budgets, tools and the audit log. You only see the screens your role allows.

An assistant with its own instructions, knowledge, tools and default model. Every chat runs through one — plain chat is an agent that used no tools.

AWS's model service, running in your account's region. The portal's models and embeddings come from here, always through LiteLLM.

A file an agent creates for you during a chat — a document, spreadsheet, slide deck or small app — that you can open, download and share.

Facts the portal keeps about you between conversations, such as your role or preferences. You can see and delete them under Settings › Memory; only you can read them.

The point, 80% by default, where a budget alert is raised. Nothing is refused.

The standard your identity provider uses to create, update and remove portal accounts automatically, so people who leave lose access.

A question the agent asks you in the middle of a turn, with suggested answers and a box to type your own. Answering continues the same turn.

Something an agent can do besides writing text: search knowledge, search the web, read a file, create an artifact, or act in a connected app.

The point, 100% by default, where new model calls are refused until the budget resets next month.

Signing in once with your company account, such as Entra ID or Okta. The portal never sees your password.

A short section of a document, cut along its headings and stored with an embedding. Search returns passages, not whole files.

The built-in department for everyone not assigned to another one, so every request always has a department to bill.

A cap on requests or tokens per minute. Unlike a spent budget it clears by itself, so the agent waits and retries a few times before giving up.

A safety check on what goes into and comes out of a model — for example blocking harmful content or sensitive data. Admins set it for the organisation.

A collection of documents agents can search and cite. Files are uploaded or synced from SharePoint, and each knowledge base has its own sharing rules.

A gateway key issued per department, so each model call is limited and billed to the right department. People never handle it.

A key for a model provider outside Bedrock, pasted by a person or a department. Calls still go through the portal's gateway, so they are billed and audited like any other.

One request to a model. A single turn can make many, and each one is logged with its own cost.

The gateway every model call passes through. It routes to Bedrock, applies each department's key and budget, and records the cost of every call.

Everything between sending a message and getting the answer: checks, model calls, tool use, pauses for you, and the reply. It keeps running if you close the tab.

Model Context Protocol, the standard way an agent talks to an outside app. The portal reaches every connected app through one MCP gateway inside your AWS account.

How deeply the portal reads a PDF or image: Text (text layer and OCR, no model), Text + figures (pictures described), or Full rewrite (a model writes out every page). Deeper costs more.

How long the model may think before answering. More effort can help with hard questions, but it takes longer and costs more.

The monthly amount a level may spend on models — organisation default, department or person. The most specific level that is set wins.

The record of who did what: every model call with its cost and department, plus admin changes and approvals.

A set of people used to give roles and to name in sharing rules. A person can be in many groups; a group never holds money.

Your equal part of your department's budget: the budget divided by the active people billed to it, rounded down to the cent.

Your yes or no before an agent changes something in a connected app. The turn pauses until you decide.

The bucket that pays: it owns a budget, limits and which models its people may use. Everyone belongs to exactly one.

A saved message you reuse from the prompt library instead of typing it again.

If any deny rule matches a person, the resource is hidden from them — even when an allow rule also matches, and even for its owner. Hidden looks exactly like missing.

Permission to do one kind of thing, such as setting budgets or reading the audit log. Roles are the only way to get one.

A resource's own sharing rules: who can find and use it, by department, group or person. Seeing a resource never grants extra permissions.

A connected-app setting that skips the approval prompt for each action. It never bypasses permissions, sign-in scope, policy or the audit log.

A reusable set of instructions an agent loads when a task calls for it, such as writing a report in your company's format.

Anything shared in the portal: agents, skills, prompts, knowledge bases, connected apps and artifacts. Resources belong to the organisation, never to a department.

Finding passages by meaning rather than exact words, using embeddings. It runs alongside keyword and document-code search, which are always on and free.

A short, safe description of what the agent is considering, shown while it works. The model's raw reasoning is never shown.

Your company's space in the portal. Each deployment runs one organisation, inside your own AWS account.

A numbered mark in an answer that links back to the passage it came from. Sources are saved with the answer and still open after the document changes.

An outside app, such as a ticketing or CRM system, that agents can use on your behalf after you sign in to it under Settings › Connected apps.

A bundle of capabilities. Everyone has one built-in role — Org Owner, Org Admin or Org User — and groups can add custom roles on top.

A role an admin creates or edits, held directly or through a group. Four capabilities, including billing, can never be put in one.

The cycle an agent repeats inside one turn: call the model, run the tools it asks for, read the results, and call the model again until it can answer.

Seeing the portal exactly as another person sees it, to reproduce a problem. It needs its own capability and is recorded in the audit log.

Reading a document again, for example at a deeper reading level. Pages a model already read are kept, so you never pay twice for the same page.

A request for something you can't do on your own — a higher budget, reading a conversation, viewing the portal as someone. Someone other than the requester decides.