A practical framework for governing AI agents in higher education.
Assess the risk, assign an owner, set the controls, and check the results, before and after an agent goes live.
Start here
- 01
Inventory
List the agents you already have, including ones built into licensed software. Record each owner, its data access, permissions, and who it affects.
Registry fields → - 02
Classify and control
Score each agent on the six lenses, set baseline controls and approvals, and write down the risks still open.
Score an agent → - 03
Pilot and monitor
Run a limited pilot, measure performance and equity, set escalation paths, and record a go, revise, or stop decision.
Evaluating →
The order matters more than the timeline. How long each stage takes depends on readiness, procurement, and risk.
Why it matters
Agents can send messages, change records, and start workflows for students and staff. Many are already on campus, turned on in licensed platforms, bought by departments, or built by faculty and students. Few campuses track them all.
They take action
An agent that changes a record needs an owner and limits. A use policy alone won't cover it.
Students carry the risk
Errors in advising or financial aid hit first-generation, disabled, and working students hardest.
Ad hoc gets expensive
Unmanaged agents duplicate cost, protect people unevenly, and leave no one accountable.
How to use it
- 01
Understand
What an agent is and how it reaches campus.
What is an AI agent → - 02
Decide
Six questions that set the oversight level.
The six lenses → - 03
Govern
Five control tiers matched to risk.
Control tiers → - 04
Apply
Scenarios, checklists, and templates.
Tools & templates →
Written for campus leaders, governance and IT teams, and the faculty and staff who build agents. Adapt it to your institution.
Start by role
The guide
- 01What is an AI agentDefinition and how agents arrive on campus
- 02Why it mattersThe institutional case for agents
- 03ImpactReported outcomes and incidents
- 04DimensionsThe 12 institutional dimensions
- 05DecidingSix lenses and risk classification
- 06ScenariosRole- and domain-based agents
- 07DoingDesign, pilot, deploy, monitor, retire
- 08GoverningControl tiers and oversight
- 09Standards crosswalkNIST AI RMF, privacy, security, accessibility
- 10EvaluatingMetrics, equity, sunset criteria
- 11Tools & TemplatesChecklists, rubrics, policy starters
- 12On campusAnnotated examples and patterns
- 13ReferencesEvery source cited
- 14About & how to usePaths by role; author and contact