Take the work with you.

What cannot change: No setting may weaken privacy policy, complementary suppression, query controls, or export review.

Implementation effort: Moderate · policy, query, export, and QA changes

Required safeguards: Small-cell and complementary suppression; repeated-query controls; trained review.

Audit requirement: Log threshold version, approver, affected views, test evidence, and rollback.

Downstream impact: Higher thresholds protect privacy but reduce detail; lower detail can affect small-population planning.

What cannot change: No scores, grades, eligibility, contracts, counseling details, or other PII in SMS or calendar text.

Implementation effort: Low for portal; moderate/high for external channels

Required safeguards: Verified consent, number/address verification, quiet hours, frequency limits, generic notices, and opt-out.

Audit requirement: Log consent source, channel, template, delivery event, opt-out, and revocation.

Downstream impact: More channels may improve reach while increasing privacy, alert-fatigue, vendor, and support obligations.

What cannot change: Staff cannot be assigned recurring individual enrollment or duplicate roster maintenance.

Implementation effort: Moderate/high · identity and source mapping

Required safeguards: Source-of-truth ownership, least privilege, exception review, reconciliation, and automatic offboarding.

Audit requirement: Log source, sync status, exceptions, role changes, deprovisioning, and reconciliation results.

Downstream impact: Automation reduces duplicate work; weak mappings can create access, orphan-account, or assignment risk.

What cannot change: No public minor profile, unapproved contact, covert tracking, or autonomous consent inference.

Implementation effort: High · identity, consent, revocation, and rights workflow

Required safeguards: Progressive consent, exact-preview approval, student visibility, correction, revocation, and minimum collection.

Audit requirement: Log notice version, verified approver, purpose, fields, sharing scope, renewal, revocation, and deletion status.

Downstream impact: More personalization can improve continuity while increasing privacy, equity, support, and legal obligations.

What cannot change: Local approval cannot replace AHSAA interpretation; AI cannot authorize eligibility, contracts, compensation, or publication.

Implementation effort: High · policy monitoring, approval, consent, and referral design

Required safeguards: Current sources, jurisdiction separation, parent exact-preview approval, conflicts screen, human determination, and referral.

Audit requirement: Log source/version, question, AHSAA interpretation, local approval, parent approval, reviewer, and expiration.

Downstream impact: Enabling opportunities may increase engagement while creating material eligibility, privacy, contract, and equity risk.

What cannot change: No expansion while a Stop remains open or required authorization/evidence is missing.

Implementation effort: Low to change count; high to support and govern expansion

Required safeguards: Stage gate, representation review, support capacity, incident plan, measurement baseline, and rollback.

Audit requirement: Log cohort definition, inclusion rationale, gate evidence, approval, incidents, and expansion decision.

Downstream impact: Larger cohorts improve learning but multiply support, privacy, training, accessibility, and incident exposure.

What cannot change: Machine translation cannot control consent, safety, eligibility, rights, or other consequential decisions.

Implementation effort: Moderate/high · translation, review, glossary, and regression testing

Required safeguards: Original-language access, translation labels, human review, glossary, accessible formats, and correction channel.

Audit requirement: Log language, translator/reviewer, source version, approval date, changed strings, and next review.

Downstream impact: Language expansion increases access while requiring review capacity and parity across every changed workflow.

What cannot change: AI cannot make discipline, placement, eligibility, admission, scholarship, personnel, purchasing, or opportunity decisions.

Implementation effort: Moderate · workflow, delegation, escalation, and evidence design

Required safeguards: Named authority, evidence preview, explanation, correction, appeal, separation of duties, and fail-closed behavior.

Audit requirement: Log draft, evidence, human decision, rationale, override, appeal, final action, and timestamp.

Downstream impact: Additional approval can reduce risk but may add delay; workflow design must prevent silent automation and bottlenecks.

What cannot change: No retaliation, coerced attribution, public raw comments, or AI finding without human/stakeholder validation.

Implementation effort: Moderate · intake, separation, redaction, and validation workflow

Required safeguards: PII screening, minimum collection, dissent preservation, translation review, access limits, and escalation notice.

Audit requirement: Log mode, notice, consent where needed, redaction, theme version, validators, dissent, and disposition.

Downstream impact: Identity can enable follow-up while reducing candor and increasing confidentiality and retaliation risk.

What cannot change: Expired, unclear, or conflicting evidence cannot silently drive action.

Implementation effort: Low/moderate · depends on source volatility

Required safeguards: Owner, review date, evidence type, limitations, conflict handling, and stale-source warning.

Audit requirement: Log source version, review date, reviewer, conflict, correction, and downstream artifacts refreshed.

Downstream impact: Faster cadence improves freshness but increases review workload; slower cadence increases stale-evidence risk.

What cannot change: Practice data cannot overwrite official ACT results; targets cannot be presented as admission, scholarship, or eligibility guarantees.

Implementation effort: Moderate · source monitoring and student/family workflow

Required safeguards: Official/practice separation, current source, deadline buffer, accommodations path, human counseling, and appeal/correction.

Audit requirement: Log target type, source/date, student/family acknowledgement, changes, official result source, and advising action.

Downstream impact: Clear targets can motivate planning; poorly framed targets can stigmatize, mislead, or narrow student opportunity.

What cannot change: No indefinite default retention, hidden telemetry, or deletion promise that ignores legal hold or documented safety obligations.

Implementation effort: High · lifecycle automation, backup handling, rights, and exception management

Required safeguards: Purpose limitation, field-level schedule, deletion verification, legal-hold process, safety exception, and export control.

Audit requirement: Log creation purpose, retention class, access, correction, deletion request, hold, deletion verification, and exception rationale.

Downstream impact: Longer retention may aid continuity and evaluation while increasing breach, misuse, discovery, and rights-management risk.