KRYOS-XS Edge / Service 02
External Sharing and Data-Movement Governance
Evaluate a sharing decision before sensitive information leaves the organization, and offer a safer method.
What this service does
The problem, the evidence, and what stays with you
The problem addressed
Donor records, beneficiary data and unpublished research leave the organization through a sharing link created in a few seconds, long before any administrator can review it.
Authorized information required
The file being shared, recipient identity and domain, existing permissions, sensitivity rules, user authority, partner status, previous sharing history and available classifications.
The intelligence layer ArtOfTheHack adds
Recipient standing, permission state and sensitivity are joined into one exposure view and weighed against potential operational and mission consequences.
The decision value you receive
A verdict before the information moves, with a safer sharing method offered where one exists rather than a blanket block.
What remains under your control
The organization's own collaboration platform performs the change, and anything exceeding the user's authority is routed for approval.
Workflow
The six-stage governed sequence
Nothing in this sequence is skipped. Evidence precedes inference, authority precedes action, and verification precedes assurance.
Stage 01
Detect
A user creates an external sharing link, adds an external recipient or widens a file permission.
Output feeds stage 02: Gather
Stage 02
Gather
The file or information being shared, the recipient identity and domain, and existing file permissions are identified.
Output feeds stage 03: Cross-check
Stage 03
Cross-check
Internal, external or public status, partner or coalition standing, previous sharing history and available data classifications are compared.
Output feeds stage 04: Evaluate
Stage 04
Evaluate
Organizational sensitivity rules, user authority and potential operational and mission consequences are applied.
Output feeds stage 05: Recommend
Stage 05
Recommend
A safer sharing method is offered where one exists: restrict the recipient list, remove public access, request approval or share through an approved partner group.
Output feeds stage 06: Record
Stage 06
Record
The evidence, verdict, user response and final outcome are preserved in the Decision Ledger.
Closes the sequence and returns evidence to the decision record
Hard boundary
Edge acts on approved collaboration surfaces and authorized API evidence only. Enforcement remains with the organization's own platform, and the visible interface never substitutes for authoritative security state.
Evidence in
What the workflow reads
- The file or information being shared
- Recipient identity and domain
- Internal, external or public status
- Existing file permissions
- Organizational sensitivity rules
- User authority
- Partner or coalition status
- Previous sharing history
- Available data classifications
Decision out
What the workflow returns
- Inline verdict with the reason stated
- A safer sharing method where one exists
- Restricted recipient list or removal of public access
- Approval request routed to the required authority
- Potential operational and mission consequence
Authority and action
Who decides, who acts, how it is verified
- Service posture
- Advisory with approval-gated action
- Acting API
- Google Drive and Workspace permission APIs.
- Approving authority
- The file owner, data steward or Workspace administrator where the change exceeds user authority.
- Verification
- Effective access is re-read after the change and the before and after state preserved.
- Rollback and reversal
- The prior permission state is recorded before any change, so the original sharing can be restored.
Connection
What must be authorized
- Approved collaboration surface in the browser
- Google Drive and Workspace permission evidence
- Delivery
- Authorized API integration, webhooks, or structured evidence submissions. No endpoint agent, no appliance, no product replacement.
- System of record
- The connected source platform remains the system of record and the point of enforcement. ArtOfTheHack proposes; the source system acts.
- Cost to the grantee
- KRYOS-XS is provided at no cost to eligible nonprofits under a grant funded by James Scott and administered by the Embassy Row Project.
- Read-only advisory operation by default
- Human approval for high-impact actions
- Least-privilege, revocable permissions
- Explicit blind spots instead of assumed facts
- Reversible enforcement wherever technically available
Product
Where this capability sits
Product 01
KRYOS-XS Edge
A browser-based security decision assistant that helps users evaluate suspicious messages, external data sharing, OAuth approvals and other consequential actions at the moment they occur.
Adjacent capabilities
Other capabilities in this product
Suspicious Message Adjudication
Determine whether a message appears legitimate, unwanted or malicious, and present the recommendation beside the message.
Cloud Exposure and Configuration Decisioning
Identify configuration changes that may create unnecessary exposure, while the change is still being made.