Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is It Safe to Let an AI Agent Access Student Records?
No, not while the agent reads the gradebook: a student record is a FERPA education record, and a model that opens the screen receives the name, grades and support plan beside the attendance facts. Require consistent tokens on the rendered page, a named person's approval of each record change, and a record of what the model received.
A district clerk opens the gradebook to post a Tuesday absence, and the page draws the whole class: names, student numbers, grades, guardian contacts and the support plan for three children in the room. An agent that takes the task receives the page as the clerk's session draws it, and every field enters a context that outlasts the absence. FERPA answers the first half of the title: the records belong to the district, and an outside party's access runs through the school official exception, which the Department of Education conditions on the district's direct control and the purposes of the disclosure (U.S. Department of Education, School Official, 2026). The exception governs who may receive a record, and it does not change what a rendered screen puts in front of a model.
A counselor drafting an intervention note, a registrar correcting a schedule and a clerk posting attendance all work on screens that draw more than the task names. The record type used throughout is a gradebook screen: one class, one term, a roster with grades, attendance marks and support-plan flags, opened by an agent under a staff member's permissions. What changes the answer for that screen is whether values are replaced before the model reads it, who approves each change, and what record the run leaves.
Key findings
- For an agent to work a gradebook safely, the values on the rendered page would have to be replaced with consistent tokens such as STUDENT_001 and GUARD_001 before the model reads it, so the run works from the roster and the grades while the names, student numbers and support-plan flags stay out of its context (What Is Render-Layer Tokenization?).
- It would also require a named person, the teacher of record or the registrar, approving each grade change, attendance correction and submission, and a record of the screen the model received, because an approval the model can decline to request is not a gate (What Is Supervised Delegation?).
- The pages reviewed describe the screens and the retrieval; none of them states that a value on a rendered student record is replaced before a model reads it, and none names the person who approves a gradebook change (PowerSchool, Family-Facing, 2026).
- A study of autonomous web agents finds they "are prone to inadvertent use of unnecessary sensitive information", which is what a roster page invites: a model asked to flag missing homework also reads the guardian contacts and the support plan (Zharmagambetov et al., 2025).
- The Department of Education treats the gradebook as a record before any question about an agent arises, since education records include "grades, transcripts, class lists, student course schedules, health records (at the K-12 level)" (U.S. Department of Education, Education Record, 2026).
- PowerSchool's release says PowerBuddy for Engagement answers "How many absences has my child had this year?" and "What is my child's grade in English?" from the student information system, and it names no privacy statute; FERPA appears nowhere on the page (PowerSchool, Family-Facing, 2026).
What does an agent read when it opens a gradebook screen?
The record is a gradebook: one class, one term, a roster in rows and an assignment in columns, with an attendance code, a grade, a guardian contact and a support-plan flag on each row. The clerk's task is one absence. The page draws the class.
A student information system draws that much on a student-facing page too. A university's guide to its Banner student self-service shows the shape: "The Account Summary page provides a high-level view of your student account, including:" "The total amount you owe", "Any holds on your account" and a "Payment portal" (North Carolina Central University, 2026). The guide is specific to one university, the page sits behind a login, and the article states no policy on retention or disclosure. It still shows what a system built to display a record puts on one screen, and a staff gradebook draws more, because the staff member has to see the class.
FERPA reaches those fields. The Department's definition turns on two things: the record relates to a student, and the institution or a party acting for it maintains the record (U.S. Department of Education, Education Record, 2026). Its examples include "grades, transcripts, class lists, student course schedules, health records (at the K-12 level)". Format does not take a record out of scope: "The information may be recorded in any way, including, but not limited to, handwriting, print, computer media" (U.S. Department of Education, Education Record, 2026). A page rendered in a browser is computer media.
What a model does with the page is measured. A study of autonomous web agents finds they "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025). The failure is an agent that reads the row for the attendance code and keeps the guardian contact, the support-plan flag and the note that a child was absent three times this month.
| What the gradebook draws | What the attendance task needs | What the model receives without a control |
|---|---|---|
| Student name and number | A way to match the row | Both, on every row |
| Attendance code | The code for one date | The code and the student it belongs to |
| Guardian contact | Nothing | The contact and the relationship |
| Support-plan flag | Nothing | The flag, which is among the most sensitive fields on the page |
| Teacher note | Nothing | The note, in full |
A record that carries a child's name, guardian contact and support-plan flag into a model's context is the wall a district meets when it tries to put an agent on this work (What Is the PII Wall?).
What do the vendors themselves say?
PowerSchool sells the student information system and North Carolina Central University publishes a guide to its Banner student page. Neither page describes a step that replaces the values on the screen before a model reads them.
PowerSchool's release describes PowerBuddy for Engagement as "a conversational AI guide that provides two-way communication" that answers family questions including "How many absences has my child had this year?" and "What is my child's grade in English?", and it names no filter between the record and the model (PowerSchool, Family-Facing, 2026). The assistant is integrated into MyPowerHub, "leveraging the PowerSchool Student Information System (SIS), the school website, and district/school documentation", so the answers come from the SIS and the release stops at the retrieval (PowerSchool, Family-Facing, 2026). The release is a launch announcement dated April 1, 2025, with feature lists and executive quotes. It says only that PowerSchool "is committed to being a good custodian of student data", names no privacy statute, and FERPA appears nowhere on the page (PowerSchool, Family-Facing, 2026).
The Banner guide is the closest thing to a vendor page for the screen: it lists the amount owed, the holds and a payment portal as the content of one summary page (North Carolina Central University, 2026). It is one university's article, the real page requires a login, and it says nothing about retention or disclosure. A guide can show what a screen draws, not what a model would receive from that screen.
| Dimension | What the documentation states | What a buyer should verify |
|---|---|---|
| Source of answers | PowerBuddy retrieves from the PowerSchool SIS, the school website and district documentation | Which fields the model receives for each answer |
| What the page draws | A Banner account summary shows amount owed, holds and a payment portal | Whether the agent needs the balance or only the status |
| Approval | None named in either page | Who approves a grade or attendance change, and where it is recorded |
| Record of what the model read | None described | Whether the district can produce the screen as the model saw it |
A district reading only these pages would learn that the vendor holds the data and has a channel for answering questions with it. It would not learn what the model keeps after an answer, which is the fact its FERPA analysis turns on. The district's own version of that question is covered in Can an AI Agent Use PowerSchool Without Student PII?.
What is a FERPA education record, and who may see it?
An education record is one "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" the institution (U.S. Department of Education, Education Record, 2026). A gradebook row is an education record, and so is the page that renders it. Dr. Judy White, retired Riverside County Superintendent of Schools, put it this way: "you as a decision maker have to make sure you take the time to find out all the information" (Does the Need-to-Know Rule Survive AI? A Former County Superintendent on Student Records).
The exception for a vendor is the school official exception at 34 CFR 99.31(a)(1)(i)(B). The Department's FAQ lists four conditions: the party "Performs an institutional service or function for which the agency or institution would otherwise use employees", "Is under the direct control of the agency or institution with respect to the use and maintenance of education records", uses the information only "for the purposes for which the disclosure was made", and "Meets the criteria specified in the school or local educational agency's (LEA's) annual notification of FERPA rights" (U.S. Department of Education, School Official, 2026).
The Department repeated the boundary in its August 2026 back-to-school letter: "In general, student information may only be disclosed to an online educational service company in compliance with FERPA." (U.S. Department of Education, Back to School, 2026). The letter does not mention AI, and a model vendor that receives the records is an online educational service company, so the district's direct control has to reach how that vendor uses and maintains them.
If the model receives the gradebook, the district has to fit the model provider under the exception and show direct control over its use of the records, a larger showing than a tokenized run requires. If the model receives STUDENT_001 and GUARD_001, the vendor never holds the record and the control question is smaller. The district's side is set out in How Do You Reduce the Risk of AI Agent Access to FERPA-Protected Student Records?. Whether a deployment meets the conditions is a determination for counsel.
Who approves an agent's change to a student record?
The consequential actions in a gradebook are few and specific: a grade change, an attendance correction, a support-plan field, an enrollment submission, a transcript release. Each one alters a record a parent can inspect and a state report can count. An approval that means anything names the person, the student, the field and the new value before the write. Statute rarely supplies that approver: of 1,143 AI bills the National Conference of State Legislatures tracked in 2025, 9 required human review or oversight of an AI decision and 1 was enacted (How Many AI Laws Require Human Review of AI Decisions?).
A product can ship with approval switched on, and an administrator can turn it off. The AI Agent Index entry for Breeze Agents records that "The default is that approval is required," while users can switch it off, and automatically triggered agents then run without approval (AI Agent Index, 2026).
A confirmation the model can click is not a gate either. The analysis in MIT Technology Review states that "because the mechanisms of refusal are probabilistic, they're never likely to be all that reliable. Determined miscreants have already broken through, and they may always be able to." (MIT Technology Review, 2026). A prompt injection that reaches the gradebook can ask the model to approve its own correction, because the refusal is a model behavior and not a control the district holds.
The approval that changes the answer sits outside the model's context. It is a decision by a named person who can see the record, taken before the write, recorded against the change rather than the session (What Is Supervised Delegation?). The record of that approval, with the screen the model received, lets a district answer a parent who asks who changed the grade (What Is an AI Control Record?).
What does a governed environment change?
A governed environment acts where the page is drawn, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the agent works with STUDENT_001 and GUARD_001 while the grades themselves stay readable. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each consequential action, and every screen, action and approval goes to a record that exports to the organization's own monitoring.
For a gradebook, the change is specific. The agent still reads the attendance code, the assignment, the term, the date and the grade, because those are the facts the task turns on. The name, the student number, the guardian contact and the support-plan flag are drawn as tokens. The model can still draft the absence notice, flag the missing assignment and reconcile the roster, because the same token follows the same child from the roster to the attendance page to the letter.
What changes is the value of a successful attack or an agent that oversteps its task. A model that holds STUDENT_001 cannot be persuaded to send a guardian's contact details it never received. The clerk still sees the real record on the screen, and the letter still carries the real name when the approved destination is the district's mail merge. The research on pseudonyms points the same way: swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (Serenari and Lee, 2025).
The scope is the rendered page. A gradebook exported to a local spreadsheet or read through a direct API call stays with the file, database and network controls a district sets for that route (What Is Least Exposure?).
What the record shows
For a district, the gradebook question turns on what the page draws before the model reads it, who approves what the model proposes, and what record survives the run. The pages reviewed describe the screens, the retrieval and the FERPA conditions, and none of them describes a substitution on the rendered record or names the approver for a gradebook change. The answer is no for the run as it usually happens, and the conditions are specific: consistent tokens before the model reads, a named person on each change, and a record of what the model received. A district can check its own setup before the next term. Open one section as the agent opens it, list every field the page draws, and compare that list with the fields the session recorded. Where the two lists match, the run needs all three conditions before an agent touches a grade. That comparison is a test any district can run on its own student information system, and it produces the evidence a FERPA review asks for.
Methodology and limitations
This page rests on education-privacy guidance from the U.S. Department of Education, a PowerSchool launch release, a university knowledge-base article on a Banner student page, two research preprints on web-agent privacy and pseudonym utility, an AI Agent Index entry and a press analysis of model refusal. The pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation, and none was tested for this page. "Not described" means the pages reviewed, and the page carries its date; vendor features change. The example describes a record type, a gradebook screen in a student information system, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about FERPA, state law or a contract belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot on the district's own screens.
Frequently asked questions
Is it safe to let an AI agent access student records?
No, not while the agent reads the live gradebook. A student record is a FERPA education record, and the page a staff session draws carries the name, the grades, the guardian contacts and the support plan beside the attendance code the task needs. An agent can work from tokens on the rendered page, and a named person can approve each change. What makes the work defensible is that substitution, the approval and the record.
What does the model receive when it opens a gradebook screen?
The rendered page, not the field the task names. It receives the roster as the district's system draws it: student names and numbers, grades and attendance codes, guardian phone numbers and email addresses, support-plan flags and teacher notes. The model can then summarize, draft or correct anything on that page. Nothing in the screen tells it which values the task needed, so the safe assumption is that it holds all of them.
Does FERPA allow an AI agent to read education records?
Only where the district has a lawful basis, and the school official exception is the one it usually uses for a vendor. It requires an institutional service, the district's direct control over the records and their use, use only for the purpose of the disclosure, and the annual notification criteria. A model that receives the records is a recipient the district must fit under those conditions. Whether a particular deployment meets them is a determination for counsel.
Who should approve a grade change the agent prepared?
A named person who owns the record, such as the teacher of record or the registrar, approving the student, the field and the new value before it is written. A default approval setting is not that person, because an administrator can switch it off, and a confirmation the model can click is not a gate. The approval belongs outside the model's context and on the record for that change.
Can an agent work a gradebook on tokens without losing accuracy?
Yes, for the work that matters. The attendance code, the assignment, the term, the date and the mark are the facts the task turns on, and none identifies a child. Consistent tokens keep a student matched across the roster, the attendance page and the guardian letter, so a draft still refers to the right child. A study of pseudonyms in conversational AI reports that consistent substitution and restoration "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (Serenari and Lee, 2025).
What record should a district keep of an agent's run?
The screens the model received as tokens, the action the agent took, and the name of the person who approved it, exported to the district's own monitoring. A platform log records the transaction against the staff account, which shows the clerk and not the agent, and it does not show which fields the model read. The record that answers a parent or an examiner is the rendered screen as the model saw it, kept with the approval.
How RedactSure Keeps the Student Record Off the Model's Screen
A gradebook screen draws the whole roster, and a model that opens it keeps every field for the rest of the run. A study of autonomous web agents finds they "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the gradebook under the clerk's session, reads the name, the guardian contact and the support-plan flag, and those values travel with every later step. Inside: the page draws STUDENT_001 and GUARD_001, the model drafts the absence notice and flags the missing assignment from the tokens, and the real values resolve only on the page the clerk approves.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A district can settle what its agent sees on a gradebook before the next term. Bring one record task and see, with test values, the page the model reads, the approval and the record. Book a demo