Glossary

A per-agent configuration that flags specific action types, bulk record updates, external sends, deletes, high-value transactions, for mandatory human review before execution. When triggered, the Agent Woorker pauses, surfaces its reasoning, and waits for approval.

An AI-powered entity in Woork that can reason, make decisions, invoke tools, and take actions on your data. Agents operate within your org's permission model and log every action to the Command Center.

Woork's visual tool for creating AI agents. Configure instructions, memory, guardrails, tool access, and MCP connections. Test agents in real time with execution traces and token usage monitoring.

Per-subject state an agent carries between conversations, such as one user’s writing voice or one account’s history. Distinct from an Agent Skill, which is shared procedure, and from a Knowledge Article, which is a shared fact.

Reusable standing guidance for an agent, covering procedure, tone and house style, stored as a record rather than hardcoded in a prompt. Skills are shared across agents, versioned, packageable, and loaded progressively so an agent pulls the full text only when a turn needs it.

A fully autonomous Woork agent that runs on a cron schedule, in response to data change events, or via inbound webhook, without a human initiating a conversation. Agent Woorkers operate under the org's permission model, respect configurable blast radius limits, and log every action to the Command Center.

Woork's core architectural principle: the convergence of Applications, Agents, and Integrations into a single unified platform. Not three products bundled together, one architecture with a shared execution context, shared security model, and unified audit trail.

An append-only log of every action taken in a Woork org. Every record creation, edit, deletion, flow execution, agent action, and API call is captured. Exportable, searchable, and linked to the originating user or agent.

A configurable hard limit on how much an Agent Woorker can do in a single autonomous run: maximum records touched, API calls made, AI tokens spent, and time allowed. When an agent hits its blast radius, it stops immediately and files a run report.

A targeted message sent to a segment of users or portal members across the channels they actually use, with delivery and engagement tracked back onto the records involved.

Agents that drive a real browser for systems with no API, running under the same permission model and audit trail as every other agent action.

Woork's unified observability dashboard. Monitor every app, agent, flow, and integration from one screen. Includes live execution feeds, WQL search, system configuration, and audit trail access.

Secure storage for API keys, tokens, and passwords used by agents and integrations. Agents authenticate from the vault, no credentials appear in prompts, logs, or code. Access is scoped to specific agents and flows.

A versioned, packageable code module called from flows and agents. JavaScript and Python run in an in-process sandbox; Java, .NET, Kotlin and any other language run in a Woork Runtime container. Every module passes static analysis, runs as the calling user unless deliberately elevated, and is capped on execution time and resources.

A reusable UI building block created in Dev Studio using JavaScript or the visual component editor. Custom Components can be embedded in app layouts, screen flows, and Process Wizards. They run in a sandboxed runtime with scoped data access and are version-controlled through the packaging system.

A complete record of an AI agent's reasoning: inputs received, tools invoked, intermediate conclusions, and final output. Every AI decision in Woork has a decision trace for audit and compliance.

A diff of exactly what a deployment will add, change and remove, shown before it runs. Combined with versioned metadata it makes a bad change a revert rather than an incident.

A Woork browser extension that brings agents, records, and flows into any web application as a sidebar panel. Unlike consumer AI extensions, the Woork Desktop Extension is server-tethered, it connects to your Woork org, operates within your org's permissions, and logs every action to the Command Center.

Woork's embedded development environment featuring Claude Code and OpenAI Codex. Write custom code, query data via WQL, test in sandboxes, and deploy, without leaving the platform.

Where API keys are issued, scoped and rotated, request logs and per-key usage are read, and the MCP configuration is copied for your own clients. Keys carry the permissions of the identity behind them, so an integration can never reach further than the person or service account it runs as.

Generation and signature built into the platform. DOCX and PDF templates with merge fields, conditional sections and repeating blocks are filled from live records by a flow or agent, then routed for signature. The envelope is itself a record, so it is queryable, reportable and covered by the same sharing rules and audit trail.

Clicking a chart to see the records behind it, in the caller’s own permission model. Every Woork chart supports it, which is why the platform has no decorative charts — a number you cannot open is a number you cannot act on.

Real-time matching that warns when a record being created already exists, using fuzzy matching on the fields you nominate. It warns rather than blocks, because a hard block on a false positive costs more than a duplicate.

The ability for an agent or flow to pause execution, persist its full context, and resume later, even after a server restart. In Woork, agents maintain durable state across multi-step processes that span hours or days.

Platform-wide change data capture. Subscribe to record and system events and react in a flow, an agent, or an outbound webhook, without polling for changes.

Whose permissions a Custom Code module runs under. The default is the calling user, so code can never see more than the person who invoked it. Elevation to a fixed user or a permission set is opt-in, restricted to admins, and audit-logged.

Control over which fields a user or agent can read and write, independent of access to the record itself. A support agent can be granted a case without ever seeing the bank details on it, and the restriction applies to agents identically.

An automated process built in Woork's Flow Builder. Flows can be triggered by record changes, schedules, webhooks, or manual actions. They support branching logic, loops, custom code, agent invocations, HTTP callouts, and human-in-the-loop approval gates.

Woork's visual automation canvas. Drag-and-drop nodes for every logic pattern: decisions, loops, record operations, HTTP calls, agent invocations, custom code, screen flows, and e-signature envelopes. Also accepts natural language descriptions.

The single resolved version of an entity assembled from several sources, with field-level lineage back to the system each value came from. Produced by Woork’s master data management, so agents and reports read one trusted record rather than four conflicting ones.

Constraints placed on AI agents to control their behavior. In Woork, guardrails include input validation, output filtering, tool restrictions, topic boundaries, and action approval thresholds. Agents that hit a guardrail stop and report.

A workflow pattern where an AI agent or automated flow pauses to request human review before proceeding. In Woork, HITL is configurable per agent and per action type. The agent surfaces its reasoning, proposed actions, and context, the reviewer approves or redirects.

A connection between Woork and an external system. Integrations can be pre-built connectors (CRM, ERP, voice) or custom HTTP configurations. Every integration call is logged and subject to Remote Site Settings validation.

Woork's tool for connecting to external systems without code. Configure connectors, map fields, set authentication, and test connections. Pre-built templates for leading CRM, ERP, data-warehouse, and HRIS systems, and more.

Built-in issue and defect tracking that links a report directly to the record, flow or agent run it came from, so reproduction context travels with the ticket instead of being pasted into it.

Model Context Protocol. An open standard that lets AI models connect to external tools and data sources. Woork is MCP-native, agents can access the built-in MCP servers (entities, email, calendar, browser, knowledge base, and more) plus any custom MCP server.

An architecture where multiple organizations share the same platform infrastructure while maintaining complete data isolation. In Woork, every record, flow, agent, and configuration is scoped to a tenant. No data crosses tenant boundaries.

A signed HTTP callout fired on a record or platform event, with retries and a delivery log. The counterpart to the inbound API for systems that want to be told rather than asked.

The baseline sharing level for each object in a Woork org. Private means only the record owner and explicit shares can access. Public Read means all users can view. Public Read/Write means all users can view and edit.

A versioned, distributable bundle of Woork components, objects, fields, layouts, flows, agents, and configurations. Packages can be installed into any Woork org or listed on The Woorkplace for distribution.

The principle that every Woork agent runs within the permission boundaries of the role it is assigned. An agent cannot read, write, or delete records that its assigned role cannot access. Enforced automatically, always.

An additive bundle of object-level, field-level, and system permissions assigned to users. Users can have multiple permission sets. An agent inherits the permission set of the role it runs under, it can never exceed those boundaries.

A scoped credential for scripting against an org as yourself. Revocable, auditable, and bound to your own permissions rather than an elevated service account.

An external-facing app for customers, partners, patients or applicants. Portal users authenticate against the same identity and permission model as staff, see only the records shared with them, and their activity lands on the same audit trail.

A guided, multi-step screen flow that walks users through complex business processes, intake forms, onboarding sequences, approval workflows. Wizards support conditional branching, field validation, file uploads, and e-signature steps. Each completion is logged with a full execution trace.

An automated review that every Woorkplace listing must pass before publication. Checks include security scanning, permission validation, documentation requirements, and production readiness verification.

Controls who can see and edit individual records. In Woork, this includes Org-Wide Defaults (private, public read, public read/write), record ownership, and manual sharing rules.

A whitelist of external URLs that Woork agents and custom code are allowed to call. Every HTTP request from a flow, agent, or custom code module is validated against this list before execution. URLs not whitelisted are blocked.

A saved report attached to a schedule, delivered to an inbox or channel. The recipient sees the numbers under their own permissions, not the author’s.

An isolated copy of a Woork org used for development and testing. Sandboxes can be provisioned in minutes from any production org. Changes are tested in the sandbox, then promoted via packaging.

A stored analytics query that powers metrics, charts and dashboards. Aggregation happens in the engine rather than in the browser, so a report over millions of records stays one query, and every chart drills through to the records behind it.

Where an agent’s guardrails are pressure-tested against real attack patterns before it goes live, including prompt injection, data exfiltration and permission escalation. Trigger rates stay monitored in production.

The ability for one agent to spawn and coordinate sub-agents for specialized tasks. A parent agent decomposes a complex goal, delegates parts to sub-agents, and synthesizes their results, all within the same permission boundary and audit trail.

Woork's marketplace for distributing and installing packaged applications. Builders create solutions, pass the quality gate, and list them. Customers install into their org with full tenant isolation.

Everything built in Woork — objects, fields, layouts, flows, agents, code and components — is stored as metadata with a version history. Changes move between sandbox and production the way code does, and reverse the same way.

A Woork agent that handles real-time phone conversations via a real-time voice integration. Voice agents can query records, trigger flows, and take actions during the call, all logged to the Command Center.

The reporting engine behind every metric, chart and dashboard. Aggregation runs in the query engine rather than the browser, so a report over millions of records stays one query, and it reads custom objects, dedicated tables and warehouse connectors through the same interface.

A container image that lets Custom Code modules run in a language the platform does not execute in-process, including Java, .NET and Kotlin, or any Docker image you supply. Runs are isolated with networking disabled, a read-only filesystem apart from a scratch tmpfs, a memory cap, and a timeout you set. The code is yours; the isolation, permissions and audit trail are the platform’s.

Woork's AI-powered document extraction feature. Upload a PDF (financial statement, tax return, invoice), and AI extracts structured data into spreading templates with calculated fields. Confidence scores flag uncertain extractions for human review.

Woork Query Language. A SQL-style query language for querying any object in a Woork org. Supports SELECT, WHERE, ORDER BY, LIMIT, and cross-object joins. Used in the Command Center, Dev Studio, and agent tool calls.