Let staff ask their AI about policies and procedures — and get answers only from what they may read.

Business situation

ABC Limited, a professional services firm, keeps its staff handbook, HR policies and IT guides in SharePoint. People ask HR and IT the same questions repeatedly: how much leave they have left under the policy, how to claim an expense, how to set up a new laptop. Some staff use Copilot, others ChatGPT.

Why existing tools alone are insufficient

A general AI does not know the firm’s policies. Uploading the handbook to each AI tool creates copies that go out of date. Connecting an AI broadly to SharePoint risks returning content that happens to be over-shared — such as a pay review spreadsheet in the wrong folder — to anyone who asks.

Systems involved

• SharePoint — the handbook, HR policies and IT guides.
• Microsoft Entra ID — who each employee is, their role, office and team.
• KroyDB — HR and IT requests.

Kroy architecture

Copilot and ChatGPT connect to Kroy. Microsoft 365 and Entra ID are connected to Kroy by IT. The Answer Policy Question Skill may search and read the designated policy sites, as the signed-in employee. The Raise HR or IT Request Skill may create a request. HR case files and salary data are classified confidential and excluded from both Skills.

Workflow

1. An employee asks Copilot: “What’s our policy on working from abroad?”
2. Kroy checks the employee’s identity through Entra ID, the agent and the Skill, then searches the policy sites with sharepoint.search and reads the relevant page with sharepoint.file.read.
3. Copilot answers from the current policy and links to it.
4. The employee asks: “What’s the salary band for a senior manager?” Kroy refuses: salary data is outside the Skill.
5. Another employee asks ChatGPT: “How do I get a second monitor?” Kroy returns the IT guide. ChatGPT explains the process.
6. The employee asks: “Raise that request for me.” ChatGPT requests request.create. Kroy creates an IT request linked to the employee.

Agent permissions

Each AI acts under the signed-in employee’s delegation and sees only what that employee can already read, within the policy sites. It can raise requests, but not edit policies.

Human permissions

Employees can read the policies SharePoint already lets them read. HR and IT own the policy sites and handle requests.

State changes

• An IT request is created, linked to the employee.
• Nothing in SharePoint changes.

Audit outcome

Kroy records each question’s sources, the refused salary request and the request raised — with the employee, the agent and the policy.

Security considerations

• Answers come from the live policy, so there are no stale copies in AI tools.
• Confidential classifications are enforced by Kroy, even where SharePoint permissions have drifted.
• Microsoft 365 credentials stay in Kroy.

Setup requirements

• Microsoft 365 and Microsoft Entra ID connected to Kroy.
• Policy sites designated and confidential content classified.
• Copilot and ChatGPT connected to Kroy.
• Both Skills enabled for all staff.