# Global search

Global search is a record finder and navigation shortcut, not a second sidebar. It searches records the current user can access and may also expose a small set of page destinations when those destinations help users reach a task.

## Scope

- Search actual records such as documents, requests, reviews, work items, assets, controls, identities, risks, and exceptions.
- Apply the same tenant, policy, and ownership rules as the destination pages. Never return a record the user cannot open.
- Keep page destinations in a separate, clearly labelled group. Do not let static navigation matches crowd out records.
- Search stable identifiers, titles, names, and useful secondary labels. Avoid indexing secrets, hidden metadata, or unrestricted body text by default.

## Trigger and results

- Place the trigger in the application topbar and show its keyboard shortcut when one exists.
- Opening the search presents a focused field and grouped results. Preserve the user's current page behind the overlay.
- Each result contains a type, primary label, and concise secondary context such as reference, owner, or status.
- Highlighting a match must not reduce text contrast or alter the underlying result label.
- Show recent destinations before a query only when they are user-specific and genuinely useful.

## Query behavior

- Begin searching after a short debounce and cancel stale requests.
- Require a small minimum query length unless a product has a safe, intentionally bounded index.
- Limit each group, show the total when known, and offer a scoped “View all” destination for larger sets.
- Empty results state that no records match. They do not suggest creating a record unless creation is the actual next task.
- A failed request keeps the query and offers Retry.

## Keyboard and accessibility

- The search trigger has an accessible name and the shortcut is supplemental.
- Arrow keys move through results, Enter opens the active result, and Escape closes the overlay and restores focus.
- Use a combobox/listbox pattern only when its complete keyboard and announcement contract is implemented. Otherwise use a dialog with ordinary links and a managed active descendant.
- Announce loading, result count, and no-result states without announcing every keystroke.

## Product boundary

The design system owns the trigger, result anatomy, grouped hierarchy, states, and interaction contract. Applications own indexing, ranking, authorization, routes, result groups, and analytics.