AI Agents in Education: Tutors, Marking and Student Data

Schools, colleges and universities are connecting AI agents to the learning management system, the student information system and staff mailboxes, which gives software that takes instructions from text the same reach into children's and students' records that a teacher or registrar has. The risks are familiar from other sectors (over-broad service identities, prompt injection, data leaving through outbound channels) but education adds three things: many users are children, the records are protected by specific education privacy law, and some uses such as admissions and exam proctoring are classed as high-risk AI in the EU. This guide covers the kinds of agent now in use, how they authenticate to education platforms, what FERPA, COPPA, the UK Department for Education standards and the EU AI Act require of them, and how to monitor and contain them. It is written for education IT and security teams, data protection officers and edtech buyers. Sector-wide security basics are in the Cybersecurity for Schools Guide and the Cybersecurity for Higher Education Guide; this page stays on agents.

Source note: legal and regulatory points on this page summarise the cited official texts and secondary analyses, with status checked on 11 November 2026. Confirm against the official text before relying on it.

Key takeaways

Classify the agent before you approve it. A learner-facing tutor, a teacher's marking assistant, an admissions or student services agent and a student's own browser agent carry different data, identities and legal duties.
The integration token is the agent's real permission. Most agents reach the LMS or SIS through OAuth client credentials or an LTI registration; scope and lifetime of that token decide the blast radius, not the vendor's privacy page.
FERPA's school official test applies to agent vendors. The vendor must perform a function staff would otherwise do, stay under the institution's direct control and be limited to records with a legitimate educational interest.
Some education uses are high-risk AI. The EU AI Act lists admission, evaluating learning outcomes, deciding the level of education and detecting cheating in tests in Annex III point 3.
Logging and safeguarding alerts are expected, not optional. The DfE product safety standards ask learner-facing products to log prompts and responses and alert the Designated Safeguarding Lead.

Where agents are appearing in education

"AI agent" covers anything from a chat tutor that only answers to a workflow that reads submissions, writes grades and emails parents. Sort every deployment into one of these groups first, because the controls follow from it.

Agent group	Typical actions	Data it touches	Usual identity	Main risk
Learner-facing tutor or study assistant	Answers questions, gives hints, generates practice questions, summarises course material	Course content, the learner's prompts, sometimes progress data	The learner's session via LTI launch, or a product account	Harmful content, jailbreaks, children's data used for training, emotional dependence
Teacher assistant (planning, marking, feedback)	Drafts feedback, suggests or writes grades, creates assignments, messages students	Submissions, gradebook, special educational needs notes	Teacher's delegated OAuth token or a tool registration with gradebook scopes	Wrong or biased grades written without review, oversharing of SEND and pastoral notes
Student services and admissions agent	Answers applicants, checks documents, ranks or triages applications, books advising	Applications, identity documents, financial aid, disability records	A dedicated service account in the CRM or SIS	High-risk AI duties, discrimination, identity document fraud, mass data exposure
IT and support agent	Password resets, account unlocks, ticket triage, licence changes	Directory, help desk tickets	Service account with help desk or identity admin rights	Social engineering of resets, prompt injection through tickets
Student's own agent (agentic browser or assistant)	Logs into the LMS, reads materials, completes quizzes and posts in forums	Everything the student can see	The student's own credentials and session cookies	Academic integrity, credential sharing with a third party, automated scraping

The last group is not deployed by the institution but still acts with an institutional identity. See the Agentic Browsers Security Guide.

How agents authenticate to education platforms

Education platforms mostly integrate through the 1EdTech Security Framework 1.0 (Final Release, May 2019), which LTI 1.3 and related specifications build on. Its patterns are a good map of where agent permissions really live.

Tool launch: LTI 1.3 uses an OpenID Connect third-party-initiated login. The platform returns a signed id_token, and the tool must validate the signature (RS256 by default), iss, aud containing its client_id, exp and a nonce to prevent replay. An AI tool launched this way acts for the launching user in that course context.
Service calls: for gradebook and roster services the tool uses the OAuth 2.0 client credentials grant with a signed JWT client assertion. The framework recommends access tokens of 3600 seconds, and scopes such as those under purl.imsglobal.org/spec/lti-ags/scope/ must be requested and confirmed. These are machine credentials: whoever holds the tool's private key can call the service.
Vendor API keys and admin tokens: many AI products also ask for a district-wide API key or admin consent in the productivity suite. These usually reach far more than one course and are the credentials to scrutinise hardest.

Practical rules follow. Register each AI tool separately so its keys and scopes can be revoked without breaking others. Grant gradebook write scopes only to tools whose use case needs them, and prefer read scopes for tutors. Record where each tool's private key or API key is stored and who can rotate it. Review the scopes on every registration each term, the same way you review OAuth consents. See the Agent Identity and Access Guide and the AI Agent Credential Lifecycle and Rotation Guide.

What the rules require of agents

Education privacy law was written for software vendors and contractors, and it applies to AI agents without modification. The table summarises the points that change agent design; it is not a full legal analysis, and status was checked in November 2026.

Rule	Who it covers	What it means for an agent
FERPA, 34 CFR 99.31(a)(1)(i)(B) (US)	Schools and institutions receiving US Department of Education funds, and the outside parties they disclose to	An agent vendor can receive education records as a "school official" only if it performs a service staff would otherwise do, is under the institution's direct control for use and maintenance of records, and follows the 99.33(a) limits on use and redisclosure
FERPA, 34 CFR 99.31(a)(1)(ii)	Same	The institution must use reasonable methods so that school officials, including an agent acting for them, reach only records in which they have a legitimate educational interest. A district-wide service account that can read every pupil's file fails this unless the function needs it
COPPA Rule as amended (US)	Operators of online services directed to children under 13	Amendments took effect on 23 June 2025 with compliance due by 22 April 2026 for most provisions; biometric identifiers such as voiceprints are now personal information. The FTC did not finalise the proposed school authorisation provisions, so do not assume a school can consent for every use
DfE Generative AI product safety standards (England)	Edtech developers and suppliers; schools use them to assess products	Robust activity logging including prompts and responses, alerts to supervisors and the Designated Safeguarding Lead, robust protection against jailbreaking, administrator-set permission levels, no commercial use of personal data and no model training on learner work without permission
DfE Generative AI in education policy (England)	Schools and colleges	Do not enter personal data into generative AI tools unless strictly necessary, do not let pupils' work train models without permission, and keep professional judgement over AI-produced content
EU AI Act Annex III point 3	Providers and deployers in the EU	High-risk: systems that determine access or admission, evaluate learning outcomes, assess the appropriate level of education, or monitor and detect prohibited behaviour during tests. Regulation (EU) 2026/1744 (Digital Omnibus on AI) entered into force on 27 July 2026 and moved Annex III obligations from 2 August 2026 to 2 December 2027 (AI Act Service Desk, Article 113)
ICO Age appropriate design code (UK)	Online services likely to be accessed by children	15 standards including high privacy by default and data minimisation; learner-facing tutors offered directly to children fall in scope

For deeper treatment see the FERPA Guide for Security Teams, the COPPA and Children's Privacy Guide and the EU AI Act High-Risk AI Systems Guide.

Threats specific to education agents

Threat	How it shows up in education	Control	Mapping
Jailbreak of a learner tutor	Pupils share prompts that get the tutor to produce harmful content or full answers	Filtering that holds across the whole conversation, jailbreak testing before each release, block notices and DSL alerts	ATLAS AML.T0054
Indirect prompt injection	Instructions hidden in a submitted essay, a forum post or a support ticket steer a marking or support agent	Treat submissions and tickets as untrusted; no write or outbound tools in sessions that read them without approval	ATLAS AML.T0051.001; SP 800-53 SI-10
Over-broad agent identity	A tool registered with roster and gradebook scopes for every course, or a district admin API key	Per-tool registrations, course-scoped access, read scopes by default, termly scope review	SP 800-53 AC-6; CSF PR.AA-05
Data leakage through generated output	A feedback email quotes another student's work or pastoral note	Exclude SEND, safeguarding and free-text pastoral fields from agent context; review mode for messages to parents	ATLAS AML.T0057
Unsafe tool invocation	An agent with gradebook write access changes grades at scale after a bad instruction	Human approval for grade writes, rate limits, change logs the registrar can reverse	ATLAS AML.T0053
Supplier compromise	Attackers steal the AI vendor's stored tokens and pull student data through the platform APIs	Supplier assessment, token inventory and fast revocation, alerts on bulk API reads	ATT&CK T1199, T1528; SP 800-53 SR-6, SA-9
Social engineering of reset agents	A caller or chat user persuades a help desk agent to reset a staff account	Identity verification outside the model, no resets for privileged accounts by agents	ATT&CK T1078

The Canvas Instructure breach in 2026 involved no AI, but it shows the path an AI support agent would also expose: a malicious support ticket ran in a human support agent's authenticated session, yielded a privileged token, and the attacker pulled usernames, email addresses, enrolment data and messages through the platform APIs. Any agent that reads customer-submitted tickets while holding a privileged token has the same shape. See the Prompt Injection Guide.

Designing learner-facing agents safely

The DfE product safety standards are the most specific published expectations for learner-facing AI, and they are useful outside England as a checklist. The points with a security or identity angle:

Filtering: block harmful content reliably across the whole conversation and on institutional accounts on every device, including personal devices.
Monitoring and reporting: log prompts and responses, alert supervisors when harmful content is accessed or attempted, and enter and confirm the DSL's contact details before the product is activated. Reports must be readable by non-specialist staff.
Security: robust protection against jailbreaking, measures against unauthorised reprogramming, administrator-set permission levels, strong authentication and safety testing before new versions are released.
Privacy and intellectual property: Data Protection Impact Assessments, defined controller and processor roles, and no model training on learner or teacher material without permission (from a parent or guardian for under-18s).
Cognitive development: by default the product should not give final answers, full solutions or complete worked examples; switching to solution modes should need friction or teacher approval.

Ask suppliers to show these working in a pilot. The AI Vendor Security Questionnaire Template covers the general supplier questions; add the safeguarding ones above.

How to roll out an education agent

Intake: record the agent group, purpose, data categories, identity and scopes, outbound channels (email, messaging, external web), the business owner and the legal basis. Decide whether the use falls under Annex III point 3.
Contract and supplier checks: confirm the FERPA school official conditions or UK processor terms, data location, retention, no training on learner data, subprocessors and breach notice time.
Identity set-up: create a dedicated registration or service identity per agent, with course- or department-scoped access and the shortest workable token lifetime. Store keys in a secrets manager, not in the vendor console notes.
Data minimisation: exclude safeguarding, SEND, medical and disciplinary records unless the use case requires them, and mask identifiers where the agent does not need them.
Pilot ring: one department or year group, review mode for all writes (grades, messages to parents, account changes), red-team the tutor with pupil-style jailbreak attempts, and review logs weekly.
Expand with guardrails: allow unattended actions only for proven, reversible tasks; keep human approval for grades that count, admissions decisions and any account recovery.
Rollback: document how to disable the tool registration, revoke its tokens and restore changed records. Rehearse it once before term starts. See the AI Agent Kill Switch and Containment Guide.

Decision guidance: how much autonomy

Use case	Suggested mode	Reason
Tutor answering questions on course material	Enable for learners after filtering, logging and DSL alerting are proven	No write access; main risk is content and safeguarding
Feedback drafts for teachers	Teacher reviews and sends	Professional judgement stays with the teacher, as DfE guidance expects
Grades that count towards qualifications or progression	Agent suggests, human decides, change logged	Evaluating learning outcomes is a high-risk use in the EU and errors are hard to unwind
Admissions triage or ranking	Avoid automated ranking unless the high-risk obligations can be met	Determining access or admission is listed in Annex III point 3
Exam proctoring and cheating detection	Human review of every flag before any consequence	Listed in Annex III point 3; false positives fall on students

Small schools and trusts: rarely have a SIEM or a security engineer. Prefer products that keep logs and safeguarding alerts in the product, restrict who can register LTI tools or grant admin consent to one or two people, and review registrations each term. Large universities and districts: run a central agent intake, put every tool registration and API key in an inventory, forward agent and API audit events to the SIEM, and include agent identities in access recertification. See the Education Identity Security Guide.

Detection and measurement

Collect three streams: the agent product's own prompt and action logs, the platform's API audit logs (LMS, SIS, productivity suite) for the agent's client_id or service account, and identity provider sign-in and consent events. Alert on:

bulk roster or gradebook reads by an agent client_id outside term patterns;
grade changes by an agent identity without a matching teacher approval;
new admin consents or new tool registrations requesting roster or gradebook scopes;
outbound messages from an agent to external domains or to parents outside approved templates;

Metrics

Agent registrations with a named owner and a scope review this term: target 100%.
Agent tokens or API keys with district- or institution-wide scope: trending to zero, each one justified in writing.
Grade writes by agents with recorded human approval: 100% for assessed work.
Safeguarding alerts acknowledged by the DSL within the agreed time: target 100%.
Jailbreak test pass rate at each product release: tracked per release, with failures blocking rollout.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	Threat reference
Supplier assessment of AI vendors	GV.SC-07	SR-6, SA-9	ATT&CK T1199
Least privilege for agent identities and scopes	PR.AA-05	AC-2, AC-6	ATT&CK T1528
Logging of agent prompts and actions	DE.CM-03	AU-2, AU-12	ATLAS AML.T0053
Untrusted input handling in agent design	PR.PS-06	SI-10	ATLAS AML.T0051.001
Legal basis and authority to process student data	GV.OC-03	PT-2	ATLAS AML.T0057

Common failure patterns

Accepting a district-wide admin consent for a classroom tool: a teacher-led pilot ends up with a token that reads every mailbox or every course.
One shared registration for several AI tools: scopes are the union of all needs and nothing can be revoked cleanly.
Letting marking agents write grades directly: errors or injected instructions in a submission change records nobody reviewed.
Feeding pastoral and SEND notes into general assistants: the most sensitive records become part of every answer the agent gives.
No owner after the pilot: the champion leaves, the tool registration and its keys remain active for years.

Practitioner checklist

Classify each agent as tutor, teacher assistant, student services, IT support or student-owned, and record its identity and scopes.
Register each AI tool separately, with course- or department-scoped access and read-only scopes unless writes are needed.
Confirm the FERPA school official conditions, or UK processor terms, in every agent contract, including no training on learner data.
Check whether the use falls under EU AI Act Annex III point 3 and plan for the high-risk obligations if it does.
Exclude safeguarding, SEND, medical and disciplinary data from agent context unless the use case needs it.
Require prompt and response logging, jailbreak testing and DSL alerting for learner-facing tutors.
Keep human approval for assessed grades, admissions decisions and staff account recovery.
Forward agent and platform API audit events to central logging and alert on bulk reads and unapproved grade writes.
Review all tool registrations, admin consents and API keys each term and remove those without an owner.
Rehearse disabling an agent and revoking its tokens before each term.

AI Agents in Education Guide: Securing Tutors, Marking Agents and Student Records