Controls for Zuora AI

Understand how tenant-level Controls define and enforce guardrails for Zuora AI, preventing AI-assisted actions that conflict with your organization’s business policies.

Controls

Controls are tenant-level rules that govern how Zuora AI behaves for all users in your tenant. Administrators can use Controls to set additional guardrails for AI-assisted actions and responses. For example, a Control can prevent Zuora AI from writing off invoices above a specified amount, even if the user has permission to perform invoice write-offs in Zuora.

Controls can be scheduled to start or end on specific dates. This is useful for time-limited policies, such as a temporary restriction during financial close or a specific compliance period.

Note that Controls are available only in Zuora AI Chat. They are not available through MCP.

What Controls can do

Controls can help your organization enforce business policies for AI-assisted work. Common examples include:

Use case	Example
Limit financial actions	Restrict invoice write-offs or credit memos above a specified amount.
Require confirmation	Require specific information to be confirmed before an operation proceeds.
Enforce compliance language	Guide how AI discusses revenue recognition or financial reporting.
Restrict action types	Prevent AI from performing selected categories of actions.

To get ideas for Controls, you can ask Zuora AI:

What are 10 Controls I should create?

How Controls are enforced

Active Controls are automatically applied when users interact with Zuora AI. Users do not need to select or enable them during a conversation. If a requested action violates an active Control, Zuora AI stops the action and explains which Control is being enforced. Controls apply to all users in the tenant, regardless of individual role or permission level.

Use a Behavioral Control when Zuora AI must not perform an operation or must stay within a defined business limit. Use an Approval Control when the operation may proceed only after another user reviews it. You can configure both controls for the same operation when you need to enforce a restriction and require independent approval.