Manual verification is a feature, not a bug

When people first hear what Koora is building, a common reaction is to ask why we do not simply automate everything. Upload a document, run it through a model, get a green tick in seconds. It sounds efficient. In most software contexts, a human in the loop is treated as a cost to be engineered away, a temporary scaffold until the algorithm is good enough.

We see it differently. In care, the moment a person looks at a credential and makes a judgement is not friction to be removed. It is the point.

The two things that have to be true

There are two separate questions any compliance layer has to answer, and they are often blurred together.

The first is: does this document actually say what it claims to say? A certificate, a police check result, a training record. Is it legible, current, issued to this person, and free of the obvious signs that something is off.

The second is: is this credential genuine according to the body that owns it? That is a different and harder question, and it can only be answered where an authoritative register exists to ask.

We are deliberately precise about the language here, because the distinction matters to the people relying on it. We review a credential when a person assesses the document itself: for a worker's own uploads that happens once their passport is shared or requested, and across an organisation's records it is the Crew service. We verify a credential only where we can check it against an authoritative source: AHPRA for registered health practitioners, the public state Working with Children Check lookups (VIC, QLD, WA, TAS and the NT), and the relevant ban and exclusion registers. Where no such source exists to query, we do not pretend one does. The record says which act a credential got, every time.

Why a person, on purpose

A model can flag a blurry scan or a mismatched name faster than any human. We use automation for exactly that kind of work, and we should. But automation is confident in a way that is dangerous in a safeguarding context. It returns an answer whether or not the answer is sound, and it does not feel the weight of being wrong about whether someone should be working with a vulnerable person.

A deliberate human review introduces something automation cannot: hesitation. The willingness to look twice, to notice the thing that does not fit a pattern because no one has seen that pattern before, to escalate rather than guess. In a sector where the cost of a false green tick is measured in harm to a person who cannot easily protect themselves, that hesitation is not inefficiency. It is the safeguard.

This is the thesis Koora is built on, not a claim we have already proven at scale. We are early, and we would rather name the stage we are at than dress up an aspiration as a track record. But the design choice is deliberate: build the trust-creating step in from the start, rather than bolt human review on later once an automated system has already lost people's confidence.

What this does not mean

Being careful about verification language cuts both ways, and the most important caveat is for providers.

We check every credential against the requirements for the role, review documents once a share or request puts them in front of us (or through Crew, where an organisation attaches it), verify at source where we can, and keep a worker's Career Passport current so the same checks do not have to be redone from scratch at every new engagement. What we do not do is take on your legal responsibility. The duty to satisfy yourself that a worker is eligible before you engage them, and to keep the records your regulator expects, stays with you. We are designed to make that duty far lighter to discharge, not to absorb it.

That framing is intentional. A platform that quietly implied it had "handled" compliance would be doing providers a disservice, because the obligation does not actually move. What actually happens is that the checking is done in one place, so you can make the call with far less effort and far better evidence behind you. If you want the longer view on how to weigh these things when choosing a tool, we wrote about it in choosing care sector compliance software.

AHPRA is not a screening check

One precision point worth stating plainly, because it is easy to get wrong. AHPRA registration tells you a practitioner is registered to practise. It does not stand in for worker screening. Under the Aged Care worker screening requirements, the acceptable checks are a recent National Police Check (Nationally Coordinated Criminal History Check) or an NDIS Worker Screening Check, and AHPRA registration is not a third option that substitutes for either. We verify AHPRA status because we can, and separately we review or verify the screening check on its own terms. Conflating the two would be exactly the kind of shortcut our approach exists to avoid.

The longer game

There is a version of this product that races to make everything instant and treats every manual step as technical debt. We are not building that version.

We think the durable thing in care compliance is not speed for its own sake. It is being the layer that providers and workers can trust precisely because it does not overclaim. Verify where there is something to verify against. Review with genuine care where there is not. Say which is which, every time. Keep the legal duty where the law puts it.

That is a slower story to tell than "fully automated compliance in seconds." We think it is the only accurate one, and in a sector built on protecting people, that accuracy is the feature. We're here to uplift care, and you do not uplift care by being careless about the one step that decides who gets to do it. For the wider picture of how these checks fit together, see care sector worker screening compliance.