1. Which data classifications may be sent to which AI tools? Security · Data governance
2. Do contracts cover FERPA, retention, and no training on institutional data? Procurement · Legal
3. Who is accountable for AI-generated code that reaches production? IT leadership
4. What disclosure is expected from students, staff and researchers? Provost · Research office
5. How are assessments redesigned so learning is still demonstrated? Faculty senate · Teaching center
6. Are agents sandboxed with scoped, revocable credentials? Security engineering
7. Is accessibility testing a release gate for AI-built software? Accessibility office
8. How are licenses of generated and suggested code reviewed? Legal · Open-source office
9. Is equitable access to licensed tools guaranteed for every student? Student success · IT
10. Which delivery and learning outcomes will tell you it is working? Institutional research
11. Is there a registry of agents and automations, each with a named owner? Security · IT operations
12. Are budgets, rate limits and a kill switch set for shared AI resources? IT finance · Platform team
13. Are shared data definitions and stewards in place before agents reach a system? Data governance · Institutional research

After proliferation

Know which agents are running

Once building is cheap, the number of agents and automations outgrows anyone’s memory. A policy can say who may build; these controls show what was built, what it can reach and what it costs.

1. 01A registry of agents and automationsEvery agent, scheduled job and automation that touches institutional systems is listed with its owner, purpose, data it reads, systems it writes to and review date. See campusairegistry.com for a registry model.Security · IT operations
2. 02Scoped, revocable credentialsEach agent gets its own service identity with the narrowest scope, never a person’s login. Credentials expire and can be revoked in one place.Identity and access management
3. 03Budgets and rate limitsPer-team token and API budgets, alerts at thresholds and a kill switch, so one runaway loop can’t drain a shared pool.IT finance · Platform team
4. 04Audit logs that outlive the builderActions are logged to a central store the builder can’t edit, kept on the institution’s retention schedule rather than in a personal account.Security operations
5. 05Shared-resource limitsQuotas on compute, storage and calls to the student information system and other shared systems, enforced by the platform rather than by goodwill.Enterprise architecture
6. 06OffboardingWhen a builder leaves or changes role, their agents are reassigned or retired, and their credentials revoked, as part of normal offboarding.HR · IT service management

Sequencing

Fix the data before scaling agents

Agents multiply whatever disorder the data already has. If three offices define a “registered student” three ways, three agents will report three numbers, faster and with more confidence. Settle the foundations in this order; campusdatagov.com covers data governance in depth.

1. 01Agree on definitionsPublish a data dictionary for the terms agents will query: enrolled, registered, active, full-time, retained.
2. 02Name ownersEach data domain has a steward who approves which agents may read it and for what.
3. 03Point at the source of truthAgents read the system of record, not exports, spreadsheets or shadow copies.
4. 04Set access rulesMap each data classification level to roles and approved tools before any agent credential is issued.
5. 05Then scaleAdd agents domain by domain, starting where definitions are already settled.

Licensing, IP and open source

Who owns what the model wrote

The checklist asks how licenses are reviewed. In practice, four questions come up for research software and operational tools alike.