@@ -203,6 +203,10 @@ case "$group" in
     export REDIS_URL=redis://127.0.0.1:6379
     export NEXT_PUBLIC_FORCE_HOSTED=false
     export COPILOT_TOOL_PERMISSIONS_ENABLED=true
+    export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
+    export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
+    export MSHIP_SEARCH_INTEGRATION_TOOLS=true
+    bunx --no-install playwright install --with-deps chromium
     export INTERNAL_API_SECRET=desktop-inbox-http-ci-local-secret-at-least-32-characters
     export DB_TX_TRIPWIRE=throw
     start_app desktop-inbox 3019 'desktop executor' record-http-status
@@ -212,6 +216,16 @@ case "$group" in
     DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
       bun run test:desktop-inbox:e2e
+    ASSISTANT_ACTIONS_E2E_BASE_URL="$local_app_url" \
+    ASSISTANT_ACTIONS_E2E_DATABASE_URL="$DATABASE_URL" \
+    ASSISTANT_ACTIONS_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    ASSISTANT_ACTIONS_E2E_REPORT_PATH="$report_dir/assistant-actions-ui-report.json" \
+      bun --no-env-file scripts/test-assistant-actions-e2e.ts
+    ORGANIZATION_SEARCH_E2E_BASE_URL="$local_app_url" \
+    ORGANIZATION_SEARCH_E2E_DATABASE_URL="$DATABASE_URL" \
+    ORGANIZATION_SEARCH_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    ORGANIZATION_SEARCH_E2E_REPORT_PATH="$report_dir/organization-search-ui-report.json" \
+      bun --no-env-file scripts/test-organization-search-e2e.ts
     ;;
 
   project-files)
 
@@ -94,6 +94,7 @@ test('source authorization returns to its desktop screen and refreshes live', as
       json({
         credentialGroup: null,
         availableProviders: [],
+        assistantProviders: [],
         availableMcpConnectors: [],
         canManage: false,
         indexingAvailable: true,
 
@@ -56,7 +56,7 @@ function SidebarScrollArea() {
       className={cn('min-h-0 flex-1 overflow-y-auto overscroll-contain', scrollFadeClass)}
       {...scrollFadeAttributes(edges)}
     >
-      <div className='flex flex-col gap-px px-2 py-4 lg:pr-3.5 lg:pl-[calc(var(--nav-inset)-8px)]'>
+      <div className='flex flex-col gap-px px-2 py-4 lg:pr-3.5 lg:pl-[calc(var(--nav-inset)-8px)] [&>[data-separator]:first-child]:mt-0'>
         <SidebarTree key={root.$id} nodes={root.children} />
       </div>
     </div>
 
@@ -121,7 +121,7 @@ export function SidebarFolder({ item, children }: SidebarFolderProps) {
 
 export function SidebarSeparator({ item }: SidebarSeparatorProps) {
   return (
-    <div data-separator className='mt-4 mb-1.5 px-2 first:mt-0'>
+    <div data-separator className='mt-4 mb-1.5 px-2'>
       <p className='text-[var(--text-icon)] text-caption'>{item.name}</p>
     </div>
   )
 
@@ -30,9 +30,10 @@ Ask Sim to build workflows, research a topic, create files, query tables, or act
 
 ## Start a chat [#how-it-works]
 
-1. Select **New chat** in the sidebar.
-2. Choose **Build** for the workspace actions described in this section. Where available, **Search** answers questions from connected sources.
-3. Describe the task, its inputs, and the result you want.
+1. Select **New chat** in a workspace, or **Home** in the organization sidebar.
+2. Describe the task, its inputs, and the result you want.
+
+For questions about connected sources, open **Search → Assistant** in the organization view. Use the **Search** tab to browse results. See [Sim Search](/search).
 
 **Plan** helps research needs and develop a solution before implementation. It appears only for eligible platform administrators with **Super admin mode** enabled on a deployment that enables this capability. An organization Admin role alone does not enable it.
 
@@ -43,7 +44,7 @@ For example:
 - "Create a workflow that takes a contract PDF, extracts key terms, and emails a summary to legal."
 - "Add a daily schedule to the prospect workflow and deploy it. At 8am America/New_York, find new high-fit prospects and post them to #outbound in Slack."
 
-Chat can work across accessible resources. When you open Sim inside a workflow, that conversation is scoped to the workflow. In the organization view, **Build** requires permission to create organization workspaces; each action in an existing workspace still checks its access and enabled capabilities. Available actions depend on your role, connected accounts, workspace settings, and organization policy. Planning a solution does not by itself authorize deploying it or sending messages.
+Chat can work across accessible resources. When you open Sim inside a workflow, that conversation is scoped to the workflow. In the organization view, **Home** requires permission to create organization workspaces; each action in an existing workspace still checks its access and enabled capabilities. Available actions depend on your role, connected accounts, workspace settings, and organization policy. Planning a solution does not by itself authorize deploying it or sending messages.
 
 ## Add context [#adding-context]
 
 
@@ -67,6 +67,7 @@ Sim requests these scopes when someone connects a Jira account. For a self-hoste
 | `read:cmdb-schema:jira` | View Assets object schemas |
 | `read:cmdb-type:jira` | View Assets object types |
 | `read:cmdb-attribute:jira` | View Assets object type attributes |
+| `write:sprint:jira-software` | Create and update Jira Software sprints |
 
 ## Use the block [#usage-instructions]
 
@@ -353,10 +354,45 @@ Create a new Jira issue
 | `summary` | string | Issue summary |
 | `success` | boolean | Whether the issue was created successfully |
 | `url` | string | URL to the created issue in Jira |
+| `warning` | string | A requested follow-up that failed after issue creation; do not recreate the issue |
 | `assigneeId` | string | Account ID of the assigned user \(null if no assignee was set\) |
 
 </ReferenceDetails>
 
+### Jira Create Sprint
+
+Create a future sprint on a Jira Software board
+
+<ReferenceDetails>
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `domain` | string | Yes | Jira site domain, such as yourcompany.atlassian.net |
+| `originBoardId` | number | Yes | Numeric ID of the Jira Software board that owns the sprint |
+| `name` | string | Yes | Sprint name |
+| `goal` | string | No | Sprint goal |
+| `startDate` | string | No | Planned start as an ISO 8601 timestamp with timezone |
+| `endDate` | string | No | Planned end as an ISO 8601 timestamp with timezone |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `warning` | string | Creation succeeded but sprint details are unavailable |
+| `sprint` | json | Created sprint with id, self, state, name, originBoardId, and optional goal, startDate, endDate |
+|   ↳ `id` | number | Sprint ID |
+|   ↳ `self` | string | Sprint REST URL |
+|   ↳ `state` | string | Initial state: future |
+|   ↳ `name` | string | Sprint name |
+|   ↳ `originBoardId` | number | Origin board ID |
+|   ↳ `goal` | string | Sprint goal |
+|   ↳ `startDate` | string | Planned start timestamp |
+|   ↳ `endDate` | string | Planned end timestamp |
+
+</ReferenceDetails>
+
 ### Jira Bulk Read
 
 Retrieve multiple Jira issues from a project in bulk
 
@@ -65,6 +65,7 @@ Sim requests these scopes when someone connects a Jira account. For a self-hoste
 | `read:cmdb-schema:jira` | View Assets object schemas |
 | `read:cmdb-type:jira` | View Assets object types |
 | `read:cmdb-attribute:jira` | View Assets object type attributes |
+| `write:sprint:jira-software` | Create and update Jira Software sprints |
 
 ## Use the block [#usage-instructions]
 
 
@@ -188,6 +188,7 @@ Plain JavaScript without imports runs in isolated-vm within Node child workers i
 | Variable | Description |
 |----------|-------------|
 | `COPILOT_API_KEY` | API key for the default Sim service. Required for Chat, the Sim Chat workflow block, and Inbox operations that use that service |
+| `MSHIP_SEARCH_INTEGRATION_TOOLS` | Opt in to personal-account reads and reviewed actions in Search Assistant. Off by default. Applies when AppConfig is disabled or no feature-flags document is available; an available AppConfig document takes precedence. Requires organization account setup and configured provider credentials. Tool permissions and source restrictions still apply. See [Connect your account](/search/connect-your-account) |
 | `NEXT_PUBLIC_CHAT_DISABLED` | Set to `true` to hide the Chat module: the workspace lands on your first workflow, with no chats list or editor Chat panel. Chat is shown when unset; `bunx sim-setup` sets it for you if you skip the chat key |
 | `PII_URL` | Base URL of the Presidio service backing PII detection and redaction. The Helm chart wires it to its own `pii` Service when `pii.enabled`; on Compose point it at the PII service on your network. Local development and the Helm fallback use `http://localhost:5001`; that address works only when the service is reachable there. Point production at a running service to use redaction |
 | `ADMIN_API_KEY` | Admin API key for GitOps operations and organization provisioning |
 
@@ -11,8 +11,8 @@ Your organization must enable Search and make a source available to you. [Connec
 
 ## Ask your first question
 
-1. Open **Home** in the organization sidebar. From a workspace, open the workspace menu and select **Back to organization** first.
-2. If Home shows a conversation-mode menu, choose **Search** before sending your first message. Members without builder access start in Search automatically and can ask immediately.
+1. Open **Search** in the organization sidebar. From a workspace, open the workspace menu and select **Back to organization** first.
+2. Choose **Assistant** at the top of the Search view.
 3. Ask a specific question and press **Enter**.
 
 For example:
@@ -32,7 +32,7 @@ Include the project, topic, or timeframe that matters. If you know where the ans
 
 > Find our launch plan in Confluence. Summarize the scope and the launch date, with sources.
 
-Search mode finds and reads information. You can also ask it to [draft content from the findings](/search/ask-questions#draft-from-your-sources); the draft stays in the conversation until you choose where to use it.
+Assistant finds and reads information. You can also ask it to [draft content from the findings](/search/ask-questions#draft-from-your-sources); the draft stays in the conversation until you choose where to use it.
 
 ## Check the sources
 
@@ -121,7 +121,25 @@ Continue with specific revisions:
 
 Provide a style example or brand guidance when consistency matters. Check names, numbers, dates, links, and commitments against the sources. For an external audience, include only information intended for that audience and keep internal supporting material separate for your review.
 
-Copy the reviewed draft into the app where you want to use it. Search creates text in your conversation; it doesn't send or publish the draft or change source records.
+Copy the reviewed draft into another app, or ask Assistant to create it using your connected account when that operation is available.
+
+## Review actions
+
+When integration actions are enabled, Assistant can answer questions and take supported actions in the same conversation. For example, ask it to draft an email in Gmail or create a Jira issue using your own connected account.
+
+Reads run without a prompt by default. Writes wait for review by default. Open **Review** to see the app, account, destination, and proposed content. Edit the supported fields, then select **Allow** or **Cancel** for each action. For several proposals, **Allow N shown** approves the actions currently displayed in the review.
+
+<Image
+  src="/static/search/assistant-action-review.png"
+  alt="Assistant action review showing the connected Jira account, exact site and project, editable issue summary and description, and Allow or Cancel controls"
+  width={1440}
+  height={1000}
+  variant="result"
+/>
+
+Each decision applies to that proposal. Changing its account or destination requires a new proposal. An action can still fail if your account is disconnected or an administrator changes access before execution. If the provider outcome is unknown, check the original app before asking Assistant to repeat a write.
+
+Configure persistent **Allow**, **Ask**, or **Block** preferences under **Integrations → Tool permissions** for your account. See [tool permissions](/search/connect-your-account#tool-permissions).
 
 ## Start from a document
 
 
@@ -12,7 +12,7 @@ After your admin adds a source in **Settings → Sources**, connect your own acc
 1. Join the Sim organization through its invitation or SSO. Use the verified email required by the provider connection.
 2. Open **Integrations**, find the provider, and select **Connect**.
 3. Complete authorization in the new tab. If the popup is blocked, allow it and select **Connect** again.
-4. Return to **Search** or **Home** and search for content your account can open. Read a result and follow its source link.
+4. Return to **Search** or **Search → Assistant** and search for content your account can open. Read a result and follow its source link.
 
 <Image
   src="/static/search/connect-confluence.webp"
@@ -39,10 +39,36 @@ You do not choose repositories, channels, labels, or an indexing method during p
 | Confluence service account | Connect Confluence. Both your account and the service connection must read the selected content. |
 | Coda | Connect personal Coda MCP. Service mode also verifies the parent document with its REST token. |
 | GitLab | No personal connection. Your verified Sim email must match current GitLab identity and permissions, or the admin's CSV mapping and project grant. |
-| [Generic Secrets, Member mode](/search/generic-secrets) | Select **Manage secrets** in Integrations and save your own values for Build and Plan. |
+| [Generic Secrets, Member mode](/search/generic-secrets) | Select **Manage secrets** in Integrations and save your own values for organization Home conversations. |
 
 Gmail, Calendar, and Drive have separate grants. Connecting one does not authorize the others. Except for GitLab's permission model, a service account restricts resources rather than replacing your personal connection.
 
+Creating Jira sprints requires the Jira sprint permission. If your account was connected before sprint actions were added, reconnect it to grant that permission. Existing Jira operations continue to use their existing permissions.
+
+## Tool permissions
+
+When Assistant integration actions are enabled, open **Integrations** and select **Tool permissions** beside your connected account. Set a preference for each operation or use the **Read-only tools** and **Write tools** group controls:
+
+| Preference | Behavior |
+| --- | --- |
+| **Allow** | Runs without a review prompt, within your account and organization permissions. |
+| **Ask** | Waits for you to review the exact proposal. |
+| **Block** | Cannot run through Assistant. |
+
+Read-only operations default to Allow; write operations default to Ask. An organization can require review even when you select Allow. A group-level Allow covers the currently listed operation versions; newly added or changed operations still ask. **Reset** restores the group's current default for that operation.
+
+These preferences belong to your account. They cannot grant access to another person's credentials or bypass an administrator's source restrictions. If a related app uses a restricted Search source, direct operations remain unavailable; Assistant can search and read within the configured scope.
+
+<Image
+  src="/static/search/assistant-tool-permissions.png"
+  alt="Connected account settings with Read-only tools and Write tools groups and per-tool Allow, Ask, and Block preferences"
+  width={1440}
+  height={1000}
+  variant="result"
+/>
+
+Apps used only for actions appear under **Assistant apps**. An admin makes the app available in organization source settings, then each member connects their own account in Integrations.
+
 ## Reconnect or disconnect
 
 Use **Reconnect** when a grant expires, is revoked, or needs more scopes. A temporary provider outage does not necessarily require reconnecting.
Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,7 @@ function SidebarScrollArea() {`
`56`	`56`	`className={cn('min-h-0 flex-1 overflow-y-auto overscroll-contain', scrollFadeClass)}`
`57`	`57`	`{...scrollFadeAttributes(edges)}`
`58`	`58`	`>`
`59`		`- <div className='flex flex-col gap-px px-2 py-4 lg:pr-3.5 lg:pl-[calc(var(--nav-inset)-8px)]'>`
	`59`	`+ <div className='flex flex-col gap-px px-2 py-4 lg:pr-3.5 lg:pl-[calc(var(--nav-inset)-8px)] [&>[data-separator]:first-child]:mt-0'>`
`60`	`60`	`<SidebarTree key={root.$id} nodes={root.children} />`
`61`	`61`	`</div>`
`62`	`62`	`</div>`
Original file line number	Diff line number	Diff line change
`@@ -121,7 +121,7 @@ export function SidebarFolder({ item, children }: SidebarFolderProps) {`
`121`	`121`
`122`	`122`	`export function SidebarSeparator({ item }: SidebarSeparatorProps) {`
`123`	`123`	`return (`
`124`		`- <div data-separator className='mt-4 mb-1.5 px-2 first:mt-0'>`
	`124`	`+ <div data-separator className='mt-4 mb-1.5 px-2'>`
`125`	`125`	`<p className='text-[var(--text-icon)] text-caption'>{item.name}</p>`
`126`	`126`	`</div>`
`127`	`127`	`)`