Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees Student Grades?
The model receives the grade with the student it belongs to, because a gradebook renders both, and a vendor that receives the pairing is an outside party under FERPA. Ask what the model receives from the rendered page, who approves a change, and whether the identity can be replaced with a stable token first.
A gradebook is one page with two kinds of value on it: the score a teacher recorded and the student the score belongs to. When an AI agent opens that page to answer a question about a quiz or to draft a note to a parent, the browser renders the whole table, and the model receives the pairing, not the single cell the task named. That pairing is what makes the page an education record, and it is what a vendor receives when an assistant is wired to the student information system.
The people who feel this first run the student information system: a technology director asked to switch on an assistant, a registrar whose transcript process now includes an agent, a teacher who wants the week's scores summarized. A parent email that quotes another child's grade is a disclosure no recall can undo, and a grade that reaches a model's context can reappear in a summary, a ticket or a later task. Permissions decide whether the agent may open the page. They do not decide what the model is shown once it loads.
The distinction that matters is between a grade and a grade tied to a student. A score with no identity attached is data an agent can compare, average and summarize. A score with a name, a student identifier or a class schedule attached is a record about a person, and the identity is the part that has to come off before the model reads the screen. The question for a district is concrete: which of those values the model receives, and who approved the run that received them.
Key findings
- Grades tied to a student stay out of a model's context only when the values on the rendered gradebook are replaced with consistent tokens such as STUDENT_001 before any model reads the screen, with the real values resolving only at an approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each grade change and a record of which screens the model read, because an approval gates the action and says nothing about what the page already showed (How Do I Let a Coding Agent Use a Test Database That Contains Real Customer Data?).
- None of the pages reviewed states that the grade figures a gradebook renders are replaced before the model reads them; they describe the gradebook, the roles that open it and the assistant that answers from it (WSIPC, 2026).
- The Department of Education's definition puts grades first: education records are those "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" it (Department of Education, Education record, 2026).
- A vendor that receives a grade tied to a student is an outside party, and the school-official exception reaches it only when it "Performs an institutional service or function for which the agency or institution would otherwise use employees" and is "under the direct control" of the district (Department of Education, School official, 2026).
- PowerSchool's release says PowerBuddy for Engagement answers "What is my child's grade in English?" by "leveraging the PowerSchool Student Information System", a flow that puts the grade and its student in front of the model, and the release names no privacy statute (PowerSchool, 2026).
What does an agent receive when it opens a gradebook?
The record is a gradebook: one page in a student information system that lists a class roster down the left and assignments across the top, with a score in each cell and a course grade at the end of the row. STUDENT_001 sits in the first row, with the identifier the district assigned, the student's name where the page shows it, and the marks for the term. An agent asked to check one quiz score opens the page, the browser draws it, and the model receives the rendered text: every row in view, the column headers, the assignment names, the scores of the students above and below, and the course grade that summarizes them. The field the task named is one cell in that table.
WSIPC's Qmlativ catalogue describes a Gradebook "designed by teachers for teachers" with "real time progress reports", a description of the teacher's screen and not of what a model receives when an agent opens it (WSIPC, 2026). The same catalogue says the Security module lets a district manage "staff, student, and guardian users and their access to the database" through Security Groups and Roles, a boundary on who may open the record rather than on what the model receives (WSIPC, 2026). A role that limits a teacher to one class still renders every student in that class.
Dr. Judy White, retired Riverside County Superintendent of Schools, said on a HAL podcast: "you have to actually teach more privacy laws for your teachers. You have to talk to your staff about confidentiality at a greater level" (Does the Need-to-Know Rule Survive AI? A Former County Superintendent on Student Records).
The catalogue records the Special Education module's "bi-directional integration with PCG's IEP Online software", so a student's gradebook row can sit beside a disability record (WSIPC, 2026). If the page shows names, the model has names; if it shows only identifiers, it has identifiers that map to one student in the district.
What happens to a grade once the model reads it?
A grade that reaches the model stays in the context for the rest of the run. It can surface in the summary the agent writes for the teacher, the email it drafts to a parent, the note it leaves on the record, or a later task that starts from the same conversation. The reading is the event: the value is in context when a later page, a tool output or an injected instruction tries to use it.
Adaptive attacks bypassed 12 published defenses against jailbreaks and prompt injections with an "attack success rate above 90% for most," which is why a filter on the page cannot be the control that keeps a grade out of the model (Nasr et al., 2025). The paper's point is that the attacker moves second.
The run is not a container. Web-delivered attacks made GPT-4o multi-agent systems execute malicious code in 58 to 90 percent of trials, so a grade read by one agent can travel through the next one (How Do You Protect Sensitive Data Across Multiple AI Agents?). An education workspace that does not train on content by default still lets the model receive content from permitted applications, and the key holder is not disclosed (Can Schools Enable OpenAI Dots on Student Records?). A training setting governs what the vendor does with the content after the run; it does not govern what the model reads during it.
The district's question is whether the grade had to be in the model at all, or whether the agent could have worked on a token while the identity stayed on the page.
What do the vendors themselves say?
Four vendor pages describe the record or the assistant that reads it, and none describes a step on the rendered page that replaces the values before the model reads them.
PowerSchool's release says PowerBuddy for Engagement answers "What is my child's grade in English?" by "leveraging the PowerSchool Student Information System", a flow that puts the grade and its student in front of the model, and the release names no privacy statute (PowerSchool, 2026). The release says only that PowerSchool "is committed to being a good custodian of student data"; FERPA appears nowhere on the page (PowerSchool, 2026).
WSIPC's Qmlativ catalogue describes a Gradebook "designed by teachers for teachers" with "real time progress reports", and it records a Security module that manages "staff, student, and guardian users and their access to the database" through roles, which governs who may open the record, not what the model receives (WSIPC, 2026).
The 2025 AI Agent Index entry for watsonx Orchestrate records that "predefined guardrails and policies are enforced automatically", and it found no dedicated approval settings, guardrails on action rather than on what the model receives (AI Agent Index, 2026).
1Password's OpenShell post states that "the agent sees placeholders rather than real credentials" and that the gateway replaces a placeholder with the real value only when the agent sends a request to an approved host, a substitution design for credentials that says nothing about the grades a gradebook renders (1Password, 2026).
The record has already left the district once: the PowerSchool breach of December 2024 took records of about 62 million students and 9.5 million teachers through the vendor's own support portal (Can an AI Agent Use PowerSchool Without Student PII?).
| Vendor page | What it documents | What a buyer should verify |
|---|---|---|
| PowerSchool PowerBuddy | Answers grade questions from the Student Information System; the release names no privacy statute | Whether the assistant reads the whole roster or one record, and where the model runs |
| WSIPC Qmlativ | Gradebook, security roles, special education integration | Which fields a role still renders, as opposed to which records it opens |
| watsonx Orchestrate | Automatic guardrails; no dedicated approval settings found | Who approves a grade change outside the platform |
| 1Password OpenShell | Placeholders for credentials at approved hosts | Whether the same substitution reaches a gradebook page |
Across these pages the control that matters here, values replaced on the rendered gradebook before the model reads them, is not described in the pages reviewed.
Are grades education records when they are tied to a student?
The Department of Education's definition puts grades first: education records are those "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" it, and the examples include "grades, transcripts, class lists, student course schedules, health records (at the K-12 level)" (Department of Education, Education record, 2026). A gradebook page is an education record when it ties a score to a student.
Disclosure to a model vendor is the second half. FERPA permits disclosure without consent only under an exception, and a contractor's access relies on the school-official exception. The Department's FAQ says the exception reaches an outside party that "Performs an institutional service or function for which the agency or institution would otherwise use employees" and is "under the direct control of the agency or institution with respect to the use and maintenance of education records" (Department of Education, School official, 2026). Its use is bounded to "the purposes for which the disclosure was made" (Department of Education, School official, 2026). The regulation requires institutions to "use reasonable methods to ensure that school officials obtain access to only those education records" in which they have a legitimate educational interest (Electronic Code of Federal Regulations, 2026).
The Department's back-to-school letter states that "In general, student information may only be disclosed to an online educational service company in compliance with FERPA", and the letter does not mention AI (Department of Education, Back to school, 2026). Direct control is a contract clause and a review process, not a vendor setting (How Can Schools Use AI Without Exposing Student Records?).
A grade without identity is data only if the identity is gone. The district's FERPA guide records that the definition reaches indirect identifiers and information a reasonable person in the school community could use (How Do You Reduce the Risk of AI Agent Access to FERPA-Protected Student Records?). A name removed while the class, teacher, term and assignment stay is not removed.
What does a governed environment change?
A governed environment moves the control to the point where the page is drawn. Values chosen by policy are replaced with consistent tokens before any model reads the screen, so STUDENT_001 reaches the model as STUDENT_001 and each score as GRADE_001, and those tokens hold for the whole run. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at an approved destination, at the moment of an approved action; for a grade change, that destination is the record a named person released.
Permission decides whether the agent may open the gradebook; substitution decides what it sees when it does. A class roster that renders names and scores becomes a table of tokens, so the student above and below the one the task named are not in the context to be repeated. Every tokenized screen, action and approval with a name is written to a record the organization can export.
The utility objection needs evidence. Swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques", so a task that compares STUDENT_001's score with the class average is doing the comparison it did before (Serenari and Lee, 2025). What it cannot do is tell anyone which student scored it.
The scope is the rendered page. A grade pulled through a direct API call is outside this control, and a district that moves records that way needs a control at that layer. The category is set out in What Is Render-Layer Tokenization?, which describes why the layers below the screen are blind to a model that reads the rendered page.
What the record shows
On a rendered gradebook the control that decides what the model holds sits before the model: consistent tokens on every page of the run, a named person approving the change or the message, and a record of what each screen showed. The vendor pages describe the gradebook, the roles that open it and an assistant that answers grade questions from the system, and the Department's pages describe when an outside party may receive the record. None of them describes a step that keeps the pairing of student and score out of the model. A district should run one check: seed a test gradebook with a made-up student, ask the agent to report that student's score, then search the transcript for the seeded name and the score. If both appear together, the page rather than the approval is where the disclosure happened.
Methodology and limitations
This page rests on two research preprints on privacy and injection, vendor documentation from 1Password, WSIPC and the 2025 AI Agent Index, Department of Education guidance, the eCFR consent exceptions, one press release and existing RedactSure research pages. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation, and none was tested for this page; "not described" means the pages reviewed. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a gradebook with a seeded student identifier, not an organization.
Determinations about FERPA, state student privacy law or a district's contracts belong to counsel, assessors and the organization's own compliance officers, and nothing here replaces a pilot of one workflow on the district's own screens.
Frequently asked questions
What happens when an AI agent reads student grades?
It reads them with the student's identity attached. A gradebook renders the roster and the scores in one table, so the model receives the pairing even when the task names a single cell. That pairing is what the Department of Education describes as an education record, and a vendor that receives it is an outside party whose use is bounded by the school-official exception. A grade with no identity attached is data.
Are grades still education records if the student's name is removed?
Only if nothing else on the page identifies the student. The definition turns on whether the information is directly related to a student, and a class, teacher, term and assignment can rebuild that relation when the roster is small. The district's FERPA guide records that the definition reaches indirect identifiers and information a reasonable person in the school community could use. Removing a name is a start; removing the link is the test.
Does the school-official exception cover an AI vendor?
Only when the district can show the conditions. The vendor has to perform an institutional service the district would otherwise use employees for, stay under the district's direct control for the use and maintenance of the records, limit its use to the purpose of the disclosure and meet the criteria in the annual FERPA notice. A confidentiality clause alone does not describe what the model receives, and the district's counsel has to read the contract.
Who should approve a grade change an agent proposes?
A named person with authority over the record, such as the teacher of record or the registrar. An approval prompt governs the action the agent takes, not the rows the screen returned before it, so the approver should see the change and the record it came from. The operator who launched the agent is not that person by default, and the approval should be recorded against the specific change.
What record should exist after an agent opens a gradebook?
The record has to show the screen the model read, the action it took and the person who approved it. A log of actions answers the middle question only. Those three elements, exported to the district's own monitoring, let a reviewer compare the page with what the model held. A transcript alone is not that record, because it shows what the agent said rather than what the page rendered.
What should a school ask an AI vendor for in writing?
Ask what the model receives from the rendered screen, where the model runs, how long a grade stays in its context and which person approves a change. Ask whether values can be replaced with tokens before the model reads the page and where the real values resolve. A vendor that answers only with training settings or access roles has not described the reading.
How RedactSure Keeps a Gradebook Out of the Model's Context
An agent that opens a gradebook reads every name and score, while the access roles and approvals reviewed above bound where it goes rather than what it reads. Adaptive attacks bypassed 12 published defenses with an "attack success rate above 90% for most," so a filter on the page cannot be the control (Nasr et al., 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opens the gradebook and the model receives the student's name with the marks beside it, and the context keeps them for the run. Inside, the page renders STUDENT_001 and GRADE_001, the real values resolve only at the record a named person releases, and the run shows who approved.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A gradebook that renders once stays in the model's context for the rest of the run. Bring one grade task and see, with test values, what the model reads and who approves the release. Book a demo