Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees a Student ID?
On a gradebook the string is a key, and the model receives it beside the grades it opens, so the record behind the identifier travels with the run. Ask what the model was handed on the rendered page and whether a named person approved the change the agent submitted.
A district that lets an agent work its student information system exposes the string that keys every screen: the student ID. It sits in the roster, at the top of the gradebook, on the billing page and in the state report, and it is the value a clerk pastes into a search field to bring up a record. A gradebook is the plainest case, because the identifier appears in a column beside a grade for every student in the class, and an agent asked to enter a missing score reads the whole column rather than the one cell it was sent to change. The score is the least of what the model keeps. It keeps the identifier, the name the identifier belongs to and the grades attached to both, and the identifier is the value that makes the other screens reachable in the same session. The controls a district already owns answer a different question: tool rights decide which buildings a clerk or a teacher may reach, and the disclosure rules attach to what the district handed the operator of a model, not to what the page showed the person at the desk. Between those two questions sits the one that decides the title: what the page delivered to the model, and who answered for the change that followed.
Key findings
- For a student ID to stay out of a model's context, the identifier column on the rendered gradebook would have to be replaced with consistent tokens such as STU_014 before any model reads the page, with the real values released only at the record save a person approved (What Is Render-Layer Tokenization?).
- It would also require a named person approving each grade change the agent submits and a record of what the model received, because an approval that arrives after the run does not clear the identifier from the context the run already built (Does the ChatGPT Compliance API Record What the Agent Did in the Browser?).
- The gap sits at what the model receives: the pages reviewed document masks and rights aimed at the person who signs in, and none of them states that the identifier a gradebook renders is replaced before a model reads it (Oracle, 2026).
- The Department of Education defines an education record as information "directly related to a student and that are maintained by an educational agency or institution", and its FAQ lists grades, class lists and course schedules among the examples (U.S. Department of Education, Education Record, 2026).
- Infinite Campus's tool-rights catalog states that "All SSNs initially display as XXX-XX-XXXX" and tells administrators to "Review User Groups and Suggested Tool Rights as a starting point" while cautioning "These are suggestions", which decides what a person may open and not what a model reads (Infinite Campus, 2026).
- Serenari and Lee found that replacing identifiers with consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques", which is the question a registrar asks about a token in the ID column (Serenari and Lee, 2025).
What lands in the model's context when the gradebook renders?
The record is a gradebook for one section: a roster in rows, a student ID column, a name column, one column per assignment and a term selector above them. An agent asked to enter a missing score for one student opens that page and reads the rendered text, and what arrives is every row in view. The identifier in each row is the same string the profile, the attendance history and the account page use as their lookup value, so a page that begins as grade entry carries the key to three other screens.
| What the gradebook draws | What the task needs | What the model receives |
|---|---|---|
| Student ID column, every row | The identifier of one student | Every identifier in view |
| Name column | Nothing, if the identifier is the key | Every name beside every score |
| Score cells | The one score being entered | Every score in the section |
| Term and section label | The current term | The term, the section and the class |
| Roster order | Nothing | A list that pairs each identifier with a name |
A screenshot is the same content in another form. A browser agent that captures the page sends the image to the model, and the image carries the identifier and the grade together, which means the reading survives a tool that never exposes page text.
The part that matters for the rest of the run is the identifier. It is short, it is unique to one student, and it is what a search field or a later page accepts. A run that holds it can open the profile, pull the schedule or check a hold without being given the value again, and that is what makes it more than one field in one cell.
Is a student ID an education record under FERPA?
The Department of Education's definition is broader than the word "record" suggests. Its FAQ places grades, transcripts, class lists and course schedules inside the term, and it says the form does not matter, since the information "may be recorded in any way, including, but not limited to, handwriting, print, computer media" (U.S. Department of Education, Education Record, 2026). A student ID with a grade beside it is information about one student, maintained by the district, so it is an element of an education record rather than a label outside one.
The disclosure test is the school official exception, and it is about the recipient. A contractor can qualify when it "Performs an institutional service or function for which the agency or institution would otherwise use employees" and when it "Is under the direct control of the agency or institution with respect to the use and maintenance of education records" (U.S. Department of Education, School Official, 2026). The department adds that the information "may be used only for the purposes for which the disclosure was made", a condition on the vendor's use of the record rather than on the page a model reads (U.S. Department of Education, School Official, 2026). A district fits a vendor's agent under that exception, and the control it has to show is over the provider (How Can Schools Use AI Without Exposing Student Records?).
The regulation carries the same shape. Institutions "must use reasonable methods to ensure that school officials obtain access to only those education records" in which they have a legitimate educational interest (34 CFR 99.31, 2026). That is an instruction about who may reach a record, and it leaves open what a screen draws once someone, or something, is inside.
The Student Privacy Policy Office applied the condition to service companies in August 2026, writing that "student information may only be disclosed to an online educational service company in compliance with FERPA", and the letter does not mention AI (U.S. Department of Education, Letter, 2026). What a district can answer without counsel is narrower and more useful: what did the page hand the model, and can it show that the answer was a consistent token.
What do the vendors themselves say?
Four pages describe how these systems draw a record and who may open it: Oracle's setup documentation for national ID types, Infinite Campus's tool-rights catalog, a university's Banner advisor page and a university's Banner self-service article. Each documents the part of the system it covers.
| Dimension | What the documentation states | What a buyer should verify |
|---|---|---|
| National ID mask | A mask is a format string of X and @, so 123-45-6789 with "the masking format is XXX@XX@@@@@" displays as XXX-XX-6789 (Oracle, 2026). | Whether the mask changes the value the page renders or only the value a person reads |
| Mask scope | "The length of the mask format must be equal to the length of the National ID", and the mask governs display only, with a separate stored value (Oracle, 2026). | Which of the two values a model would receive on the same screen |
| Rights catalog | "All SSNs initially display as XXX-XX-XXXX", and administrators are told to "Review User Groups and Suggested Tool Rights as a starting point" (Infinite Campus, 2026). | Whether the rights decide anything about content, or only who may open the page |
| Advice, not a rule | The catalog cautions that its suggested rights are "These are suggestions" (Infinite Campus, 2026). | What the district's own configuration does where the catalog is silent |
| Identifier on a person page | The "Additional Identification" tab of Banner's SPAIDEN displays "the student's ID card # and login ID" (Robert Morris University, 2026). | Which staff roles can open that tab, and what the page hands a model |
What the four pages do not describe is what a model receives when the rendered page is handed to it, since each of them stops at the person who signs in.
The closest thing to an agent in the set is PowerSchool's family assistant, and the release says the assistant answers questions by "leveraging the PowerSchool Student Information System (SIS), the school website, and district/school documentation", which puts a vendor's model on the far side of a page built for a parent (PowerSchool, 2026). A launch announcement with executive quotes is not a privacy statement, and FERPA appears nowhere on the page.
The identifier opens more than grades. North Carolina Central University's article on Banner self-service says the account summary shows "The total amount you owe", "Any holds on your account" and a payment portal, which is what the same identifier reaches on the billing side (North Carolina Central University, 2026). The record the identifier opens has been taken before, since a breach of one vendor's support portal reached about 62 million students, which is why a district asks what a model receives before a pilot rather than after one (Can an AI Agent Use PowerSchool Without Student PII?).
What do tool rights govern, and what does the rendered page still show?
A right decides which person may open which page. Banner's security classes and PeopleSoft's roles are the mechanism, and the page a class permits is the page a member of that class can open (Can an AI Agent Work in Banner or PeopleSoft Without Seeing Student Social Security Numbers?). An agent working inside a staff member's session inherits that reach, and an agent with its own account gets a reach someone configured for it. Dr. Judy White, retired Riverside County Superintendent of Schools, framed the rule behind those rights on a HAL podcast: "You can't go out and share everything that you know" (Does the Need-to-Know Rule Survive AI? A Former County Superintendent on Student Records).
Neither arrangement changes the page. The gradebook renders the same identifier column for a teacher, a substitute and an agent, and the mask Oracle documents is a display format applied to one field type rather than a change to what the page holds.
The approval sequence does not govern the reading. A teacher who approves a grade change at the end of the run has approved the write, and the identifier, the names and the other students' scores entered the context before the approval was requested (Is It Safe to Let an AI Agent Access Student Records?). An approval can stop a change. It cannot unread a page. Requiring a person to review the decision is the exception: 1,143 AI bills were tracked in the 2025 state sessions, 9 required that review, and 1 was enacted (How Many AI Laws Require Human Review of AI Decisions?).
Three things are worth asking for in writing: what the model receives from the rendered page, who approves each record change by name, and what record of the screens and approvals the district will hold. Only the first decides whether the identifier was ever in the model's hands.
How do you keep a student ID out of what the model reads?
Replace the identifier when the page renders. A policy names the field, and the page draws a consistent token in its place, the same token for the same student on every screen of the run: STU_014 on the gradebook, STU_014 on the profile, STU_014 on the attendance page. Consistency is what keeps the work possible, because the agent can still match a row to a student without holding the identifier.
The real value resolves only at the destination the district approved, at the moment of an approved action: the registrar's save, or the teacher's submission of the grade. The model that drafted the change does not hold the value at any point in the run.
The objection is that the task breaks. On the recorded evidence it does not, when the substitution is consistent and reversible: masking that keeps the same token for the same value across a run preserves the structure an agent reasons over (Does Masking Data Still Let an AI Agent Complete Its Task?), and Serenari and Lee measured the cost of inconsistent redaction at a factor of five in semantic utility errors.
Where the digits of an identifier carry nothing the task needs, the token costs the run nothing. A teacher reads the row to find the child, not to learn from the number, and the agent does the same with a label that points at the same child.
What does a governed environment change?
It changes what the model receives, which is the point the pages reviewed leave open. A governed environment replaces the values a policy names with consistent tokens before any model reads the rendered screen, keeps the same token for the same value across every page of a run, and releases the real value only at the destination a person approved.
For the gradebook the change is concrete. Before, the model reads the identifier column, the names beside it and every score in the section, and a later step can search the identifier to open the profile. Inside, the page renders STU_014 in the identifier column, the agent enters the grade it was asked for, a named person approves the submission, and the real identifier resolves at the SIS record rather than in the model's context (What Is Render-Layer Tokenization?).
Two further parts make it a control rather than a filter. A named person approves each consequential action, and every screen as tokens, every action and every approval is written to a record the district can export to its own monitoring, which is what answers a parent's question about what an agent saw.
The scope is the rendered page. A direct API integration, a nightly export or a report built from the warehouse is a different path with its own controls, and a browser control does not govern a file the agent opens outside one.
What the record shows
The control that answers this question sits at the render, not at the account: the identifier replaced with a consistent token before any model reads the page, a named person approving each grade change, and a record of what the model received. On the pages reviewed, the identifier is drawn for whoever opens the gradebook and the vendor controls decide who that is, while the model's view of the same page is left open. The disclosure test then turns on what the district handed to the operator, and the school official exception asks for direct control and a stated purpose, which is easier to show when the model never held the value. A registrar can test one section: open its gradebook, list every field the page draws, mark the ones the model would receive, then ask for the same page with the identifier replaced and the real value released only at the save a named person approved.
Methodology and limitations
This page rests on agency guidance, a regulation, vendor documentation and a preprint: two FERPA FAQs and a back-to-school letter from the department, the eCFR text of 34 CFR 99.31, Oracle's PeopleBooks page for national ID types, Infinite Campus's tool-rights catalog, two university Banner pages, PowerSchool's family-assistant announcement, and the Serenari and Lee preprint. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for it. The products are described from their public documentation, and "not described" means the pages reviewed do not state the point. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a gradebook, not an organization. Determinations about whether a practice meets a legal or contractual requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the district's own screens.
Frequently asked questions
What does the model receive when an agent opens a gradebook?
The model receives the page as the browser draws it: the identifier column, the names beside it and every score in the section, not the single cell the task named. From that point the identifier stays in the context for the rest of the run, so a later step can use it to open the profile, the schedule or the account page. The task needed one row.
Is a student ID an education record under FERPA?
Yes, once a record is attached: the identifier is a string on its own, and beside a grade, a schedule or an attendance entry it is part of an education record, which the Department of Education describes as information "directly related to a student" and maintained by the institution. Its FAQ lists grades, class lists and course schedules as examples. Whether a particular agent arrangement fits the school official exception is a question for the district's counsel.
Does masking a student ID on the screen keep it out of the model?
No, not by itself. A mask is a display format, and Oracle's page is explicit that it governs display only, with a separate stored value behind it. Whether a model receives the masked form or the stored form depends on where the substitution happens, which is a question about the specific screen rather than about the mask. Ask what the model received, not what the clerk saw.
Who approves a grade change an agent submits?
Someone with the authority to make the change: the teacher of record for a grade, the registrar for an enrollment or identity edit. The approval should name the change and the student rather than the agent's access in general. It also arrives too late to govern the reading, because the identifier and the other rows entered the context when the page loaded. A gate at the write end does not reach back into the transcript.
What record should a district keep of an agent's work on a gradebook?
The screens the model received as tokens, every action the agent took, and every approval with a name against it, exported to the district's own monitoring rather than held only by the vendor. That record answers the question a parent or an auditor asks later: what did the agent see, what did it change, and who said yes. A log of actions alone leaves the reading out of the record.
Does a token in the ID column break the gradebook?
No, when the token is consistent. The agent does not need the digits; it needs a stable label that points at one student, and a token supplies that on the gradebook and on every page that follows. The risk runs the other way: Serenari and Lee found that consistent pseudonyms cut semantic utility errors against baseline, so inconsistent substitution is the failure. A token that changes between two screens breaks the match the agent needs.
How RedactSure Keeps a Student ID Out of the Model's Context
An agent that opens a gradebook reads every identifier in the section, and the rights reviewed above govern who may open a page, not what the model reads. Swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques," so a token in the ID column costs the run nothing (Serenari and Lee, 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the model receives the identifier column, the names and every score. Inside, the page renders STU_014 in that column, the agent enters the grade it was asked for, and the real identifier resolves only at the SIS record a named person approved.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A gradebook that renders once puts every identifier in the section into the model's context for the rest of the run. Bring one grading task and see, with test values, what the model reads and where the real identifier lands. Book a demo