@@ -133,7 +133,9 @@ export function SearchSourceSetup({
   }
   const failedQuery = index.isError ? index : null
   const initialMode = (type: string) =>
-    type === 'github' || type === 'slack' ? ('members' as const) : ('admin' as const)
+    type === 'github' || type === 'slack' || setup['source-access'] === 'members'
+      ? ('members' as const)
+      : ('admin' as const)
 
   const selectedAccessMode = selectedType ? initialMode(selectedType) : undefined
   const selectedAvailability = selectedMeta
 
@@ -3,6 +3,7 @@ import { sha256Hex } from '@sim/security/hash'
 import {
   dbChainMockFns,
   flattenMockConditions,
+  queueTableRows,
   resetDbChainMock,
   schemaMock,
   storageServiceMock,
@@ -105,6 +106,12 @@ function mappedDocumentPlan(): ForkContentPlan {
 describe('copyForkResourceContent', () => {
   beforeEach(() => {
     resetDbChainMock()
+    for (let attempt = 0; attempt < 4; attempt++)
+      queueTableRows(schemaMock.knowledgeBase, [
+        { id: 'src-kb', isSearchIndex: false },
+        { id: 'child-kb', isSearchIndex: false },
+        { id: 'existing-target-kb', isSearchIndex: false },
+      ])
     dbChainMockFns.returning.mockResolvedValue([{ id: 'activated-document' }])
     dbChainMockFns.for.mockResolvedValue([{ workspaceId: 'child-ws' }])
     storageServiceMockFns.mockHeadObject.mockResolvedValue(null)
@@ -1138,11 +1145,15 @@ describe('planForkMappedKbDocumentCopies', () => {
     let selectCalls = 0
     const tx = {
       select: () => {
-        const rows = selectCalls++ === 0 ? docs : existingTargets
         return {
-          from: () => ({
+          from: (table: unknown) => ({
             where: (condition: unknown) => {
+              if (table === schemaMock.knowledgeBase) {
+                const rows = Promise.resolve([{ id: 'target-kb' }])
+                return Object.assign(rows, { for: () => rows })
+              }
               wheres.push(condition)
+              const rows = selectCalls++ === 0 ? docs : existingTargets
               return Promise.resolve(rows)
             },
           }),
 
@@ -48,6 +48,10 @@ import {
   hashDurableSecretProvenanceValue,
 } from '@/lib/execution/durable-secret-provenance'
 import { WORKSPACE_ACCESS_TOKEN } from '@/lib/knowledge/access/types'
+import {
+  connectorIndexingCondition,
+  requiresConnectorIndexing,
+} from '@/lib/knowledge/connectors/indexing-policy'
 import {
   createKnowledgeDocumentSourceValue,
   type KnowledgeDocumentSourceValue,
@@ -758,6 +762,7 @@ export async function copyForkResourceContainers(
         and(
           inArray(knowledgeBase.id, selection.knowledgeBases),
           eq(knowledgeBase.workspaceId, sourceWorkspaceId),
+          connectorIndexingCondition(),
           isNull(knowledgeBase.deletedAt)
         )
       )
@@ -951,17 +956,43 @@ export async function planForkMappedKbDocumentCopies(params: {
     .where(
       and(
         inArray(document.id, candidateIds),
+        exists(
+          tx
+            .select({ id: knowledgeBase.id })
+            .from(knowledgeBase)
+            .where(
+              and(
+                eq(knowledgeBase.id, document.knowledgeBaseId),
+                connectorIndexingCondition(),
+                isNull(knowledgeBase.deletedAt)
+              )
+            )
+        ),
         isNull(document.connectorId),
         isNull(document.deletedAt),
         isNull(document.archivedAt)
       )
     )
 
-  const planned = docs.flatMap((doc) => {
+  const candidates = docs.flatMap((doc) => {
     const targetKbId = resolver('knowledge-base', doc.knowledgeBaseId)
     if (targetKbId == null) return []
     return [{ doc, targetKbId, childDocId: deriveCopyIdentity('document', targetKbId, doc.id) }]
   })
+  if (candidates.length === 0) return { documents, docIdMap, mappingEntries }
+  const targets = await tx
+    .select({ id: knowledgeBase.id })
+    .from(knowledgeBase)
+    .where(
+      and(
+        inArray(knowledgeBase.id, [...new Set(candidates.map(({ targetKbId }) => targetKbId))]),
+        connectorIndexingCondition(),
+        isNull(knowledgeBase.deletedAt)
+      )
+    )
+    .for('share')
+  const targetIds = new Set(targets.map(({ id }) => id))
+  const planned = candidates.filter(({ targetKbId }) => targetIds.has(targetKbId))
   const existingTargets =
     planned.length === 0
       ? []
@@ -1690,14 +1721,20 @@ async function finalizeKbDocument(params: {
   } = params
   return db.transaction(async (tx) => {
     const [lockedKnowledgeBase] = await tx
-      .select({ workspaceId: knowledgeBase.workspaceId })
+      .select({
+        workspaceId: knowledgeBase.workspaceId,
+        isSearchIndex: knowledgeBase.isSearchIndex,
+      })
       .from(knowledgeBase)
       .where(eq(knowledgeBase.id, childKnowledgeBaseId))
       .for('update')
     assertForkCopyActive(params.control)
     if (!lockedKnowledgeBase) {
       throw new Error(`Copied document knowledge base ${childKnowledgeBaseId} is missing`)
     }
+    if (!requiresConnectorIndexing(lockedKnowledgeBase.isSearchIndex)) {
+      throw new Error('Retired Search documents cannot be activated by a workspace copy')
+    }
     if (lockedKnowledgeBase.workspaceId !== billingContext.workspaceId) {
       throw new Error(
         `Copied document knowledge base ${childKnowledgeBaseId} moved from workspace ${billingContext.workspaceId}; refusing stale storage charge`
@@ -1809,6 +1846,24 @@ async function copyKbDocument(params: {
     billingContext,
   } = params
   assertForkCopyActive(params.control)
+  const bases = await db
+    .select({ id: knowledgeBase.id, isSearchIndex: knowledgeBase.isSearchIndex })
+    .from(knowledgeBase)
+    .where(
+      and(
+        inArray(knowledgeBase.id, [source.knowledgeBaseId, childKnowledgeBaseId]),
+        isNull(knowledgeBase.deletedAt)
+      )
+    )
+  const basesById = new Map(bases.map((base) => [base.id, base]))
+  if (
+    [source.knowledgeBaseId, childKnowledgeBaseId].some((id) => {
+      const base = basesById.get(id)
+      return !base || !requiresConnectorIndexing(base.isSearchIndex)
+    })
+  ) {
+    throw new Error('Workspace copies require active ordinary knowledge bases')
+  }
   const sourceSecretContext = await loadKnowledgeDocumentDurableSecretProvenance(source.id)
   const sourceSnapshotHash = hashDurableSecretProvenanceValue(
     createKnowledgeDocumentSourceValue(source)
 
@@ -25,7 +25,7 @@ import { credentialGroupScopePolicyVersion } from '@/lib/credential-groups/provi
 import { decryptCredentialGroupProviderConfiguration } from '@/lib/credential-groups/provider-configuration'
 import { getCredentialGroupProviderAdapter } from '@/lib/credential-groups/provider-registry'
 import {
-  type CredentialGroupStandardOAuthProvider,
+  type CredentialGroupProvider,
   isCredentialGroupProvider,
 } from '@/lib/credential-groups/providers'
 import { credentialGroupScope } from '@/lib/credential-groups/scope'
@@ -87,7 +87,13 @@ function scopesEqual(left: string[], right: string[]): boolean {
 
 async function buildOption(
   scope: ResourceScope,
-  option: CredentialGroupOptionInput,
+  option: {
+    provider: CredentialGroupProvider
+    label: string
+    required: boolean
+    slackBotCredentialId?: string
+    requiredScopes?: string[]
+  },
   credentialGroupId?: string,
   executor: DbOrTx = db
 ): Promise<CredentialGroupOptionConfig> {
@@ -395,11 +401,11 @@ export async function ensureWorkspaceAccountsGroup(
   }
 }
 
-/** Adds a provider explicitly selected by an organization administrator, preserving all grants. */
+/** Adds a provider or extends its required consent during an explicit administrator action. */
 export async function addOrganizationAccountProvider(
   organizationId: string,
   userId: string,
-  option: { provider: CredentialGroupStandardOAuthProvider; label: string },
+  option: { provider: CredentialGroupProvider; label: string; requiredScopes?: string[] },
   executor: DbTransaction
 ): Promise<{ groupId: string; changed: boolean }> {
   const scope = { kind: 'organization', organizationId } as const
@@ -418,11 +424,37 @@ export async function addOrganizationAccountProvider(
       `Connected accounts contains duplicate ${option.label} settings`
     )
   if (matching[0]) {
-    if (matching[0].status !== 'active')
+    const current = matching[0]
+    if (current.status !== 'active')
       throw new OrchestrationError(
         'validation',
         `Enable ${option.label} in Connected accounts first`
       )
+    if (option.requiredScopes) {
+      const previousScopes =
+        current.provider === 'slack'
+          ? resolveSlackManagedUserScopes(current.requiredScopes)
+          : current.requiredScopes
+      const requiredScopes = [...new Set([...previousScopes, ...option.requiredScopes])]
+      const scopeVersion = credentialGroupScopePolicyVersion(requiredScopes)
+      if (!scopesEqual(requiredScopes, previousScopes) || scopeVersion !== current.scopeVersion) {
+        const [updated] = await executor
+          .update(credentialGroup)
+          .set({
+            options: existing.options.map((entry) =>
+              entry.id === current.id ? { ...entry, requiredScopes, scopeVersion } : entry
+            ),
+            updatedAt: new Date(),
+          })
+          .where(
+            and(eq(credentialGroup.id, group.id), resourceScopeCondition(credentialGroup, scope))
+          )
+          .returning({ id: credentialGroup.id })
+        if (!updated) throw new Error('Connected accounts policy update returned no row')
+        await invalidateOptionGrants(executor, group.id, [current.id])
+        return { groupId: group.id, changed: true }
+      }
+    }
     return { groupId: group.id, changed: group.created }
   }
   if (
@@ -449,6 +481,27 @@ export async function addOrganizationAccountProvider(
   return { groupId: group.id, changed: true }
 }
 
+async function invalidateOptionGrants(
+  executor: DbTransaction,
+  groupId: string,
+  optionIds: string[]
+) {
+  const enrollmentIds = executor
+    .select({ id: credentialGroupEnrollment.id })
+    .from(credentialGroupEnrollment)
+    .where(eq(credentialGroupEnrollment.credentialGroupId, groupId))
+  await executor
+    .update(credential)
+    .set({ managedOauthStatus: 'needs_reauth', updatedAt: new Date() })
+    .where(
+      and(
+        eq(credential.type, 'managed_oauth'),
+        inArray(credential.credentialGroupEnrollmentId, enrollmentIds),
+        inArray(credential.credentialGroupOptionId, optionIds)
+      )
+    )
+}
+
 /**
  * Refuses to remove account options while a knowledge
  * connector syncs per member through one of them: the connector would be left
@@ -570,20 +623,7 @@ export async function updateCredentialGroup(
 
     if (!updated) throw new Error('Credential group update returned no row')
     if (invalidatedOptionIds.length > 0) {
-      const enrollmentIds = tx
-        .select({ id: credentialGroupEnrollment.id })
-        .from(credentialGroupEnrollment)
-        .where(eq(credentialGroupEnrollment.credentialGroupId, groupId))
-      await tx
-        .update(credential)
-        .set({ managedOauthStatus: 'needs_reauth', updatedAt: new Date() })
-        .where(
-          and(
-            eq(credential.type, 'managed_oauth'),
-            inArray(credential.credentialGroupEnrollmentId, enrollmentIds),
-            inArray(credential.credentialGroupOptionId, invalidatedOptionIds)
-          )
-        )
+      await invalidateOptionGrants(tx, groupId, invalidatedOptionIds)
     }
     return toCredentialGroup(updated, await listLinkedMcpServers(updated.id, tx))
   })
 
@@ -410,7 +410,10 @@ describe('managed OAuth token resolution', () => {
   })
 
   it('allows Search reads when Slack retains a broader grant', async () => {
-    seedSlackSearchCredential('option-1', 'active', SLACK_MANAGED_USER_SCOPES)
+    seedSlackSearchCredential('option-1', 'active', [
+      ...SLACK_MANAGED_USER_SCOPES,
+      ...SLACK_SEARCH_USER_SCOPES,
+    ])
     await expect(
       resolveManagedOAuthToken({
         credentialId: 'credential-1',