AI does the work end to end; a human approves each item

InfoPol is the system of record for your compliance: risks, processes, assets, vendors, controls, documents, tasks and incidents live in one place, and every change is kept in an audit log. We handle many kinds of compliance, and we are strongest in ISO 27001, E-ITS and information security.

AbleTrace is the AI layer on top of that system. It consists of an MCP interface, a human approval gate, skills (playbooks for the AI), an audit trail and a versioned knowledge base. The reasoning happens in the AI assistant you choose; the data and the decisions stay in InfoPol.

The AI does not replace the responsible person. It does the preparation quickly and thoroughly, and a person decides.

A typical session has four steps.

1. Connect. You add the InfoPol MCP server to your AI assistant and sign in with your own InfoPol account. The assistant acts with your permissions, inside one organisation.
2. Read. The assistant reads the current state from InfoPol: live risks, controls, documents and tasks. No separate copy of your data is made.
3. Propose. The assistant proposes the missing records and links, one item at a time, with its reasoning.
4. Approve. A person reviews each proposal. Only after approval is it written to InfoPol and recorded in the audit log.

These limits are built into the system, not only written in instructions.

• Every write needs a human approval. A request without approval is rejected by the server before anything is saved.
• The AI does not complete work. A task can only be set to new or in progress, and a person finishes it. The AI can raise a control up to partially implemented; a person marks it implemented.
• The AI can prepare drafts of documents and training campaigns and create tasks and incident records, but it does not publish a document, start training, acknowledge reading or close an incident.
• Removal is two-step. The first request only previews what would be removed; it is applied only when the same request is repeated.
• Controls managed by a person are off limits. The server refuses to change them.
• A connection is bound to one organisation and to the permissions of the user who created it. Customer data is isolated from each other at the database level.

• Search risks, controls, evidence, documents and open tasks, and answer questions from the records in InfoPol
• Propose new risks, processes, assets, vendors and the links between them
• Adopt a framework and create the controls that belong to it
• Draft documents from templates and link documents to controls as evidence
• Create tasks and schedules for recurring reviews
• Check the setup for gaps and verify that the audit log chain is intact

An AbleTrace skill is a playbook for the AI assistant: which questions to ask, in what order to work, and how to cross-reference the requirements of different frameworks. The knowledge base holds methodology only, never your data. Your data is always read live from InfoPol.

The knowledge base has a version. When the assistant supplies it with an approved write, the version is stored in the audit trail, so you can see afterwards which reasoning produced a record.

Every change made with AI help is written to the audit log: who approved it, through which connection, and what changed. The log is hash-chained, so a change made afterwards is detectable. The AI can verify the integrity of the chain itself, and people see the same log in InfoPol.

You need an InfoPol account and MCP access enabled by an organisation administrator. Install the skill first, then add the MCP server.

Install the skill

Connect your AI: the MCP server

Does the AI change my data without my permission?

No. Every write needs a human approval of that specific item, and the server rejects a request without it before anything is saved.

Can the AI complete a task or mark a control as implemented?

No. The AI can only set a task to new or in progress, and it can raise a control up to partially implemented. Completing and marking implemented are human actions.

Can the AI see other customers' data?

No. A connection is valid for one organisation and uses the permissions of the user who created it. Customer data is isolated at the database level.

Which AI assistants does it work with?

Any assistant that can connect to a remote MCP server (Streamable HTTP) and sign in with OAuth, for example Claude. The steps are on the MCP page.

Can changes be traced afterwards?

Yes. Every write made with AI help stays in the audit log with the approver and the connection, and the log chain can be verified.