fix(search): harden organization setup and document access

Author: waleedlatif1

apps/docs/content/docs/search/confluence.mdx

@@ -11,7 +11,7 @@ Search pages and blog posts from selected Confluence Cloud spaces. A Sim organiz
 
 Search indexes each page's own text, including supported local callouts and code blocks. It does not expand Include Page, Excerpt Include, or third-party macros into that page. Referenced pages can be indexed separately with their own access rules.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Choose a connection method
 
@@ -40,7 +40,7 @@ On hosted Sim, personal connections authorize the existing Sim app. Teammates do
 
 ### Choose Confluence
 
-Open **Integrations**, click **Add source**, and choose **Confluence**. Click **Set up** or **Continue setup** if prompted. Select your **Connection method**.
+Open **Settings → Integrations → Providers**, approve **Confluence**, then select **Set up**. Select your **Connection method**.
 
 </Step>
 <Step>

apps/docs/content/docs/search/connect-your-account.mdx

@@ -7,7 +7,7 @@ import { Callout } from 'fumadocs-ui/components/callout'
 import { Step, Steps } from 'fumadocs-ui/components/steps'
 import { Image } from '@/components/ui/image'
 
-Your admin configures the source once. You connect your own account so Sim can establish what you are allowed to search.
+Your admin approves the provider and can configure shared source filters. You connect your own account so Sim can establish what you are allowed to search.
 
 <Steps>
 <Step>
@@ -21,7 +21,7 @@ Accept your Sim organization invitation or sign in through your organization's S
 
 ### Open Integrations
 
-Open **Integrations**, find the source, and select **Connect account**. If it is missing, ask an organization admin to add it.
+Open **Integrations**, find the provider or source, and select **Connect account**. Your first connection may ask for required source settings, such as repository or project names. If the provider is missing, ask an organization admin to approve it.
 
 <Image src="/static/search/connect-account.png" alt="Google Drive source row with Connect account" width={1280} height={720} />
 
@@ -32,14 +32,14 @@ Open **Integrations**, find the source, and select **Connect account**. If it is
 
 In the new tab, select **Connect** and complete the provider's authorization. Choose the account associated with your verified Sim email. The provider may require your organization's SSO or app approval.
 
-Return to Integrations when the connection completes. Keep the original tab open; **Open again** resumes the connection if a popup was blocked or closed.
+Return to Integrations when the connection completes. If the popup was blocked or closed, allow popups and select **Connect account** again. While authorization is pending, use **Open again**.
 
 </Step>
 <Step>
 
 ### Start searching
 
-The source row shows indexing status and how many documents are available to you. Open **Home → Search** and search for something you can already open in the source. Use **Assistant** to ask a question about your connected documents. The first sync may take time, especially for large accounts.
+The source row shows indexing status and how many documents are available to you. Open **Search** in the organization sidebar and search for something you can already open in the source. Use **Home** to ask the assistant about your connected documents. The first sync may take time, especially for large accounts.
 
 </Step>
 </Steps>

apps/docs/content/docs/search/github.mdx

@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 GitHub Search indexes text files from a repository on `github.com`. An organization admin chooses the repository, then each person connects their GitHub account. Installing the GitHub App alone does not connect your teammates.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Before you start
 
@@ -102,7 +102,7 @@ In the App's sidebar, choose **Install App**, select the target account, and gra
 
 ### Open GitHub setup
 
-As a Sim organization admin, open **Integrations**, choose **Add source**, then **GitHub**.
+As a Sim organization admin, open **Settings → Integrations → Providers**, approve **GitHub**, then select **Set up**.
 
 </Step>
 <Step>

apps/docs/content/docs/search/gitlab.mdx

@@ -11,7 +11,7 @@ GitLab Search uses an administrator connection to sync a project's content and p
 
 <Image src="/static/search/gitlab-setup.jpg" alt="GitLab source setup in Sim Search" width={1280} height={720} />
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates do not need a personal GitLab connection. For workspace Search, use **Search → Add source** instead.
 
 ## Before you start
 
@@ -49,7 +49,7 @@ The token must read the project, users, inherited project membership, instance s
 
 ### Configure the source in Sim
 
-Open **Integrations → Add source → GitLab**. Paste the token and enter your instance host explicitly.
+Open **Settings → Integrations → Providers**, approve **GitLab**, then select **Set up**. Paste the token and enter your instance host explicitly.
 
 | Field | What to enter |
 |---|---|

apps/docs/content/docs/search/gmail.mdx

@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search email threads from your own Gmail account. An organization admin enables the source; each teammate connects their own account. An admin's connection does not make their mailbox available to the team.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Set up the source
 
@@ -20,7 +20,7 @@ These steps require a Sim organization admin.
 
 ### Add Gmail
 
-Open **Integrations → Add source → Gmail**. Gmail uses **Member accounts**; there is no domain-wide or service-account crawl in Search.
+Open **Settings → Integrations → Providers**, approve **Gmail**, then select **Set up**. Gmail uses **Member accounts**; there is no domain-wide or service-account crawl in Search.
 
 </Step>
 <Step>
@@ -47,7 +47,7 @@ Click **Add source**. Gmail appears in the **Sources** list. Each person, includ
 2. Complete the connection in the tab that opens. Choose the Google account whose verified email matches your Sim email, and grant the requested permissions.
 3. Return to Integrations. The source shows its indexing status and the number of documents you can search.
 
-Teammates follow these same steps after joining the organization. They do not configure the source again. If Gmail has not been added yet, ask an organization admin to add it.
+Teammates follow these same steps after joining the organization. Once an admin approves Gmail, the first connection can create its source with default filters. Admins can configure shared filters beforehand.
 
 ## Source options
 
@@ -76,7 +76,7 @@ Search schedules syncs hourly. The first sync and large mailboxes can take longe
 | --- | --- |
 | A different email is requested | Use the Google account matching your verified Sim email. A separate personal account or alias does not satisfy the match. |
 | No searchable documents | Check the source's labels, date range, category exclusions, and search filter. Allow the first sync to finish. |
-| Finish connecting in the other tab | Complete the Google flow. If the tab was blocked or closed, allow pop-ups and click **Open again**. |
+| Finish connecting in the other tab | Complete the Google flow, or use **Open again** while authorization is pending. If the popup was blocked or closed, allow popups and select **Connect account** again. |
 | Reconnect | Click **Reconnect** and authorize the same account again. |
 | Unavailable or needs admin attention | Ask your Sim admin to check source status and the deployment's Google OAuth configuration. |
 

apps/docs/content/docs/search/google-calendar.mdx

@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search meetings and event details available to your Google account. An organization admin enables the source; every teammate connects their own account. Google controls which calendar and event details each person can read.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Set up the source
 
@@ -20,7 +20,7 @@ These steps require a Sim organization admin.
 
 ### Add Google Calendar
 
-Open **Integrations → Add source → Google Calendar**. Search uses **Member accounts**; an admin or service account cannot connect on behalf of everyone.
+Open **Settings → Integrations → Providers**, approve **Google Calendar**, then select **Set up**. Search uses **Member accounts**; an admin or service account cannot connect on behalf of everyone.
 
 </Step>
 <Step>

apps/docs/content/docs/search/google-drive.mdx

@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 
 Search Google Docs, Sheets, Slides, and supported files in Drive. A Sim organization admin chooses the folders and connection method once.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Choose your setup
 
@@ -29,7 +29,7 @@ These steps use your organization's **Integrations** page. For workspace Search,
 
 ### Add Google Drive
 
-Open **Integrations → Add source → Google Drive** and choose **Member accounts**.
+Open **Settings → Integrations → Providers**, approve **Google Drive**, then select **Set up** and choose **Member accounts**.
 
 </Step>
 <Step>

apps/docs/content/docs/search/index.mdx

@@ -16,7 +16,9 @@ Search brings your connected sources into one place. An organization admin adds
 
 ### Choose a source
 
-As an organization admin, open **Integrations → Add source** and select **Set up** beside a source. Use its **Setup guide** for the provider's prerequisites.
+As an organization admin, open **Settings → Integrations → Providers**. Approve the provider for Sim Search, then select **Set up** beside it. Use its **Setup guide** for the provider's prerequisites.
+
+Approval lets members connect; it does not connect an account or start indexing. Slack also requires an admin to configure the organization's Slack app first.
 
 </Step>
 <Step>
@@ -32,7 +34,7 @@ Select **Connect & Sync** for an administrator connection, or **Add source** for
 
 ### Connect and search
 
-In **Integrations**, select **Connect account** if prompted—even if you created the source. Complete authorization in the new tab, then return to the source list. Open **Home → Search** to find documents or use **Assistant** to ask questions about them. Documents become available as background indexing progresses.
+In **Integrations**, select **Connect account** if prompted—even if you created the source. Complete authorization in the new tab, then return to the source list. Open **Search** in the organization sidebar to find documents, or **Home** to ask the assistant about them. Documents become available as background indexing progresses.
 
 </Step>
 </Steps>
@@ -43,12 +45,13 @@ Source availability depends on the deployment and organization policy. An unavai
 
 ## Choose the right connection method
 
-Most sources have one method. Google Drive and Confluence also offer an administrator connection when enabled for the organization.
+Most sources use member accounts. Google Drive and Confluence also support a central administrator connection; GitLab requires an administrator token for a self-managed instance.
 
 | Method | What the admin does | What teammates do |
 | --- | --- | --- |
 | **Member accounts** | Sets the source's filters once. | Connect their own accounts. Sim lists documents using each member's access. |
 | **Service account** (Drive) / **Admin or service account** (Confluence) | Connects an account that can read the content and the source's permissions or directory. | Join the organization with a matching verified identity. Confluence also requires each person to connect their account. |
+| **Administrator token** (GitLab) | Connects a self-managed instance administrator token and selects projects to index. | Join the organization with a verified Sim email matching GitLab. No personal connection is needed. |
 
 Some member sources offer **Sync documents with**. **Connected members** uses members' accounts for both content and access checks. Selecting a dedicated account uses it to fetch content; members still connect to establish which documents they may search. **Browse with** only helps an admin pick source options—it does not enroll that account for Search.
 
@@ -73,11 +76,11 @@ Some member sources offer **Sync documents with**. **Connected members** uses me
 
 Invite people through the organization's **Settings → Members**, or use your organization's [SSO provisioning](/platform/enterprise/sso). Share the organization's **Home** or **Integrations** URL. People need their own Sim account and organization membership; they do not need access to a workspace. Connecting an external account alone does not grant organization membership.
 
-Organization admins manage source configuration and sync status through the source's **Manage** action. Other members connect or reconnect their own accounts. See [Connect your account](/search/connect-your-account) for the teammate walkthrough.
+Organization admins manage source configuration and sync status through **Manage** under **Settings → Integrations → Providers**. Other members connect or reconnect their own accounts. See [Connect your account](/search/connect-your-account) for the teammate walkthrough.
 
 ## Search, Assistant, and MCP
 
-**Home → Search** finds documents directly. **Assistant** can search and read the same sources to answer questions with citations. Conversations are private to their author, including when another organization member is an admin.
+**Search** in the organization sidebar finds documents directly. The assistant on **Home** can search and read the same sources to answer questions with citations. Conversations are private to their author, including when another organization member is an admin.
 
 To search from an MCP-compatible app, open **Settings → Search MCP**. Generate a personal Sim API key there, or use an existing personal key with the displayed connection details. MCP applies your current organization membership and document access.
 

apps/docs/content/docs/search/jira.mdx

@@ -11,11 +11,11 @@ Search issue titles, descriptions, and metadata from selected Jira Cloud project
 
 This Search connector uses **Member accounts**. It does not offer a central admin crawl. Comments, attachment contents, dashboards, and saved filters are not indexed.
 
-These steps use your organization's **Integrations** page. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
+Admin setup uses your organization's **Settings → Integrations** page. Teammates connect from **Integrations** in the main sidebar. For workspace Search, use **Search → Add source** instead; **Create & Invite** is the workspace equivalent of **Add source**.
 
 ## Before you start
 
-- You must be a **Sim organization admin** to add the source. Teammates can connect after it exists.
+- A **Sim organization admin** must approve Jira. An admin can configure the source beforehand, or the first member connection can supply the required site and project settings.
 - Use an Atlassian Cloud site such as `your-team.atlassian.net`. Jira Server and Data Center are not supported by this connector.
 - Each person needs a verified Sim email matching the email on their active Atlassian account, plus access to the selected Jira site and projects. Jira's **Browse Projects** and issue security permissions still determine which issues they can search.
 
@@ -32,7 +32,7 @@ Sim uses its existing Jira OAuth integration. Search uses `read:jira-work` to re
 
 ### Choose Jira
 
-Open **Integrations** in your organization, click **Add source**, and choose **Jira**. Click **Set up** or **Continue setup** if prompted. The connection method is **Member accounts**.
+Open **Settings → Integrations → Providers**, approve **Jira**, then select **Set up**. The connection method is **Member accounts**.
 
 </Step>
 <Step>
@@ -94,7 +94,7 @@ Sim checks Jira separately using each connected person's account. Issue content
 
 | What you see | What to do |
 | --- | --- |
-| No **Add source** button | Ask a Sim organization admin to add Jira. |
+| No provider setup controls | Ask a Sim organization admin to approve and set up Jira. |
 | Projects are empty or disabled | Enter the domain and connect a browsing account, or switch to manual project keys. Check that the account can browse those projects. |
 | Connected, but no issues | Confirm the authorized site matches the configured domain. Check project access, issue security, and the JQL filter. An admin's Jira access does not grant access to other members. |
 | Email mismatch | Sign in to Atlassian with the email shown by Sim's connection flow. |