A practical framework for governing AI agents in higher education.
Assess the risk, assign an owner, set the controls, and check the results, before and after an agent goes live.
Start here
Assess an agent
About 30 minutes. Score one agent on the six lenses, check its tier controls, and record the result in the intake checklist.
You leave with: a first-pass assessment of its owner, data access, permitted actions, provisional tier, and next review date.
Score an agent →Establish governance
- Inventory the agents you have, including ones in licensed software (registry fields).
- Classify and control each one and route it to the right approver.
- Pilot and monitor with stage gates and evaluation.
You leave with: ownership, intake, approval, and monitoring arrangements.
Control tiers →Explore the guide
Start with what an agent is, then the scenarios and campus patterns. The twelve dimensions are background reading, not a prerequisite.
You leave with: definitions, worked examples, and the evidence behind them.
Start with the basics →The order matters more than the timeline. How long each stage takes depends on readiness, procurement, and risk.
Why it matters
Agents can send messages, change records, and start workflows for students and staff. Many are already on campus, turned on in licensed platforms, bought by departments, or built by faculty and students. Few campuses track them all.
They take action
An agent that changes a record needs an owner and limits. A use policy alone won't cover it.
Students carry the risk
Errors in advising or financial aid can fall hardest on students with the least time, money, or know-how to get them corrected. Track who experiences errors and who gets them fixed.
Ad hoc gets expensive
Unmanaged agents duplicate cost, protect people unevenly, and leave no one accountable.
Start by role
Written for campus leaders, governance and IT teams, and the faculty and staff who build agents. Adapt it to your institution.
Executive · CAIO · CIO
Know which agents act for the institution, who authorized them, what limits apply, and what evidence keeps them running.
The guide
- 01What is an AI agentDefinition and how agents arrive on campus
- 02Why it mattersThe institutional case for agents
- 03ImpactReported outcomes and incidents
- 04DimensionsThe 12 institutional dimensions
- 05DecidingSix lenses and risk classification
- 06ScenariosRole- and domain-based agents
- 07Agents in the SISVendor agents, autonomy, and controls
- 08DoingDesign, pilot, deploy, monitor, retire
- 09GoverningControl tiers and oversight
- 10Standards crosswalkNIST AI RMF, privacy, security, accessibility
- 11EvaluatingMetrics, equity, sunset criteria
- 12Tools & TemplatesChecklists, rubrics, policy starters
- 13On campusAnnotated examples and patterns
- 14ReferencesEvery source cited
- 15About this sitePurpose, sources, privacy, author