Control · Control

Decide what AI can see and what it can do.

Kroy resolves every request against the person, the agent acting for them, the delegation between them and your organisation’s policies.

Start free All capabilities

Control

Kroy is the authorisation lawyer between your business and AI.

  1. A request travels towards your business.

    Claude, acting for Priya, asks to read ABC Limited’s invoices in Xero. The request reaches Kroy and stops.

  2. Who is asking — and what do they already hold?

    Identity first. Then what Xero itself allows, and what Priya may see in Kroy.

  3. What may this agent do for her?

    Claude’s own permissions, and the delegation Priya gave it for this session.

  4. Is it within the task and the rules?

    The Skill in use sets the scope. The organisation’s policy has the final word.

  5. Allowed — and recorded.

    Only now does Kroy execute. A request to send the invoice by email would wait for approval; a request for payroll would be refused.

Claude for Priya
Kroy
✓ Xero
IDENTITY
SOURCE PERMISSION
USER PERMISSION
AGENT PERMISSION
DELEGATION
TASK SCOPE
POLICY
! Email invoice
✕ Payroll
Claude for Priya
Kroy
✓ Xero
IDENTITY
SOURCE PERMISSION
USER PERMISSION
AGENT PERMISSION
DELEGATION
TASK SCOPE
POLICY
! Email invoice
✕ Payroll

The questions Kroy asks on every request

  1. Who is asking? The authenticated person or service.
  2. Which agent? The AI client acting on their behalf.
  3. What resource? The entity, record or system involved.
  4. What action? Read, create, update, send, publish.
  5. What delegation? What the person has authorised this agent to do.
  6. What policy? The organisation’s rules for this data and action.
  7. Approval required? Whether a person must decide first.

Only then does Kroy execute the action — and it records the outcome either way.

Human approval

Some actions should never happen without a person. A common rule: AI may draft external communication, but a person must approve before it is sent. Kroy enforces that rule at the point of action, not in a policy document nobody reads.

Policies from PolicyHQ

PolicyHQ helps organisations decide their rules in plain language. Kroy puts them into practice. Define the rules with PolicyHQ. Put them into practice with Kroy.

Case Studies using Control

Technology · Professional services

Letting AI update your website — with a person approving

Claude prepares a change set for the affected public pages. A person approves it, Kroy publishes the projection and the site rebuilds.

ClaudeCloudflareGitHub

Professional services · Financial services

Preparing a board pack with AI, and sharing it with the board

Claude assembles a draft board pack from Xero, Salesforce and KroyDB. The finance director approves it, and it appears in the board Channel. Directors can query the approved pack with their own AI, but not the ledger behind it.

ClaudeChatGPTXeroSalesforce

Accountancy

AI-assisted bookkeeping review in Xero

Claude reviews the month’s bookkeeping and proposes a change set of corrections. The bookkeeper approves the ones they agree with and Kroy applies only those. Deletions and bank detail changes are refused.

ClaudeXero

Accountancy

Onboarding a new client with AI — while the AML review stays internal

Claude sets up the client record, drafts the engagement letter and document request, and prepares the AML checklist for a person. Only the practice’s nominated officer can complete the AML review, and the client never sees it.

ClaudeOutlookSharePointXero

Accountancy

Investigating a client’s question with ChatGPT, Xero and Outlook

ChatGPT gathers the relevant Xero data and correspondence for one client, explains the answer to the manager and drafts a reply in Outlook for the manager to send.

ChatGPTXeroOutlook

Accountancy

Claude + Xero through Kroy

Claude answers questions using authorised Xero data and prepares drafts — without holding Xero credentials or reaching data the user cannot see.

ClaudeXero