The EdPlus Agentic Governance Framework
What you can build now, what needs review, and what needs approval.
Building with AI at EdPlus runs on a simple traffic light. Green means build now. Yellow means review before it goes live. Red means approval before anything ships.
Every project lands in a tier based on two things: who it reaches and what data it touches. The lower the tier, the more freedom you have.
Your leaders should have visibility into what is being built and why.
Internal assets for yourself or your team — build now
Tier 1 · Internal content
Interactive content, reports, and personal tools. Staff are free to build internal solutions for themselves. No review required.
Tier 2 · Sensitive data
Solutions that include sensitive data are allowed inside an approved enterprise tool, shared only with people who already have access to it. In Claude that is Live Artifacts; in ChatGPT Edu it is a Canvas or a custom GPT inside the ASU workspace. No reviewer needed.
Guardrail → Hosting sensitive data anywhere outside an approved enterprise tool requires a technology team consultation. That is where search engines and unauthorized viewers become the risk. See yellow for review.
The biggest risk here is quality control.
Prototype freely. Review before it goes live
3a · Hosted outside the agentic ecosystem
Needs review by the AI technology governance group if it holds or intakes sensitive data, needs to be hosted by a third party tool, or will be used by students and faculty.
3b · Quality review
Any skill or prototype going public or to our customers gets a quality review from the team whose skill you used, whether that is Content, Design, Data and Research, or Engineering, before the asset goes live.
Guardrail → Prototypes are always allowed. The gate is the moment of exposure: authentication, external hosting, or a public audience.
Deploying here without AI technology governance puts the university at risk, and can result in access to agentic tools being revoked.
Net new customer solutions and complex deployments
Tiers 4–5 · Net-new product solutions & complex deployments
Unless the work uses pre-built Rocket Design System components, all net new product work beyond exploration and prototyping needs to be consulted on, and handed off to engineering if it requires deep integration with university systems or database management. Even plugins that require university system integrations need oversight and technology team support.
Guardrail → No custom built product solution ships without full AI technology governance oversight, including plugins that touch university systems.
Which tools this covers
All of them. Every tier here applies to every AI tool at EdPlus, not just Claude: the same three tiers, the same review, and the same intake form.
The rules that never change
- Work in your ASU Enterprise account, never a personal one.
- Keep FERPA, HR, and financial data out unless explicitly approved.
- Review AI output before it leaves your hands. You own what you share.
Questions? Ask in #edplus-ai-support or reach out to the AI & Automation team.
More to learn
Guides that pick up where this one leaves off.
One short, anonymous baseline survey going out to all of EdPlus. What it asks, why it matters, and what we do with your answers.
ReadCodex is already switched on for every ASU staff member, no request form and no agreement. What it does, how to enable it, and the guardrails that still apply.
ReadThere's more where that came from.
Guides, demos, and recorded sessions all live on the Learn page. The prompt and skill libraries turn what you just read into something you can run today.