A practical framework for governing AI agents in higher education.
Assess the risk, assign an owner, set the controls, and check the results, before and after an agent goes live. For campus leaders, governance committees, IT, privacy and security teams, and the faculty and staff who build agents.
Start here
Assess an agent
About 30 minutes. Score one agent on the six lenses, check its tier controls, and record the result in the intake checklist.
You leave with: a first-pass assessment of its owner, data access, permitted actions, provisional tier, and next review date.
Score an agent →Establish governance
- Inventory the agents you have, including ones in licensed software (registry fields).
- Classify and control each one and route it to the right approver.
- Pilot and monitor with stage gates and evaluation.
You leave with: ownership, intake, approval, and monitoring arrangements.
Control tiers →Explore the guide
Start with what an agent is, then the scenarios and campus patterns. The twelve dimensions are background reading, not a prerequisite.
You leave with: definitions, worked examples, and the evidence behind them.
Start with the basics →Why it matters
Agents can send messages, change records, and start workflows for students and staff. Many are already on campus, turned on in licensed platforms, bought by departments, or built by faculty and students. Few campuses track them all.
They take action
An agent that changes a record needs an owner and limits. A use policy alone won't cover it.
Students carry the risk
Errors in advising or financial aid can fall hardest on students with the least time, money, or know-how to get them corrected. Track who experiences errors and who gets them fixed.
Ad hoc gets expensive
Unmanaged agents duplicate cost, protect people unevenly, and leave no one accountable.
Start by role
Pick your role for a short reading path.
Executive · CAIO · CIO
Know which agents act for the institution, who authorized them, what limits apply, and what evidence keeps them running.
The guide
- 01What is an AI agentDefinitions, parts, and the spectrum of agency
- 02How agents arriveTen pathways onto campus
- 03Why it mattersWhy agents need governance now
- 04ImpactReported outcomes and incidents
- 05DimensionsThe twelve institutional dimensions
- 06DecidingSix lenses and risk classification
- 07ScenariosRole- and domain-based agents
- 08Agents in the SISVendor agents, autonomy, and controls
- 09GoverningControl tiers and oversight
- 10DoingDesign, pilot, deploy, monitor, retire
- 11EvaluatingMetrics, equity, sunset criteria
- 12Tools & TemplatesChecklists, rubrics, policy starters
- 13On campusComposite patterns and what good examples include
- 14Standards crosswalkNIST AI RMF, privacy, security, accessibility
- 15ReferencesEvery source cited
- 16About this sitePurpose, sources, privacy, author