EducationManaged AI Agents

Education AI Agents,
Monitored for Accuracy

Nestack Agent Care helps education providers monitor, evaluate, and optimize AI agents used for tutoring, grading, student support, and content generation — before small AI errors become accuracy or safeguarding issues.

142failure modes
60SEV-1 failure modes
1950+baseline eval cases
24/7Agent Monitoring

Scope

Education AI agents we build & manage

Observability

What we make observable

Every education agent session is traced across ten layers — what we capture and the evidence we keep.

  1. Evidence we keep
    Goalconstraintsapproval requirement
  2. Evidence we keep
    Sourceversiontimestamprelevancecitation
  3. Evidence we keep
    Planned sequenceactual sequenceworkflow status
  4. Evidence we keep
    Task statusresultretryfailure reason
  5. Evidence we keep
    Tool nameversioninputoutputpermissionresult
  6. Evidence we keep
    Model/versioninput/outputtoken usagelatencycost
  7. Evidence we keep
    Evaluation typemetricthresholdresult
  8. Evidence we keep
    Guardrail targettriggeractionenforcement result
  9. Evidence we keep
    Reviewerdecisioncorrectionreason
  10. Evidence we keep
    Outcome statusbusiness resultlinked trace

Catalog

Failure modes

Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.

Nothing on this page matches that. Try a layer (tool, retrieval, guardrail), a code, or a severity.

0 documented↑↓ move · ↵ open · ⌘↵ filter matrix
142 documented · select a cell to filter
6
41
47
48
42
22
55
43
36
85
EDU-01Student-record privacy leaks — grades, discipline, health to unauthorized partiesSEV-1
EDU-02Safeguarding signals missed — self-harm, abuse, grooming disclosuresSEV-1
EDU-03Wrong academic guidance — credits, prerequisites, visa-affecting load changesSEV-2
EDU-04Grading assistance bias or inconsistencySEV-2
EDU-05Admissions discrimination via proxiesSEV-1
EDU-06False academic-integrity accusations — AI-detection overreachSEV-2
EDU-07Stale course, fee or deadline dataSEV-3
EDU-08Injection via student submissions and forum postsSEV-2
EDU-09Academic-integrity undermining — completing assessed work for studentsSEV-2
EDU-10Accommodation misadvice — IEP/504 supports missed or disability disclosedSEV-1
EDU-11Financial-aid and scholarship miscalculation — eligibility and amountsSEV-2
EDU-12Curriculum content errors — wrong facts or biased explanations in tutoringSEV-2
EDU-13Custody and guardian-boundary errors — info released to wrong parentSEV-1
EDU-14Age-inappropriate or harmful content reaching minorsSEV-1
EDU-15Proctoring false-cheating flags — behavioral telemetry misread at scaleSEV-2
EDU-16Identity-verification bias — face detection and behavior models failing protected groupsSEV-1
EDU-17Safety-surveillance false flags — police dispatch, discipline, protected-trait outingSEV-1
EDU-18Sycophantic tutoring — wrong answers validated, right answers overturnedSEV-2
EDU-19Overreliance scaffolding failure — answer-giving that masks learning lossSEV-2
EDU-20Companion drift — parasocial attachment and displaced help-seekingSEV-1
EDU-21Dead-end automation — adverse actions with no human escalation pathSEV-1
EDU-22Unauthorized commitments — invented policies that bind the institutionSEV-2
EDU-23Predictive-label harm — biased risk scores steering studentsSEV-2
EDU-24Consent-boundary violations — student data into training, ads or biometricsSEV-1
EDU-25Autograder validity collapse — proxy scoring gamed or skewedSEV-2
EDU-26Hallucinated citations and sources in research supportSEV-3
EDU-27Boilerplate formal documents — IEPs, recommendation letters, crisis commsSEV-2
EDU-28Language-inconsistency — answers differ across languages and translationsSEV-2
EDU-29Accessibility failures — assistive-tech breakage and caption inaccuracySEV-2
EDU-30Vendor-custody failure — collapse, breach or orphaned student dataSEV-1

A · Student-support & advising agents

GU-03Superseded source quoted01 · RetrievalSEV-3
GU-04General rule read onto one student02 · ReasoningSEV-1
GU-06Course-load advice to a visa holder02 · ReasoningSEV-1
GU-02Registration touched, not explained03 · Tool / writeSEV-1
GU-05Disclosure written to a shared note03 · Tool / writeSEV-2
GU-01Answer without a source04 · OutputSEV-2
GU-07Silent policy regression05 · Change / VersionSEV-2

B · Admissions assistants

AZ-03Unredacted file retrieved01 · RetrievalSEV-3
AZ-04Race rebuilt from proxies02 · ReasoningSEV-1
AZ-06Judgement turned into a formula02 · ReasoningSEV-1
AZ-02Disability note written to record03 · Tool / writeSEV-1
AZ-05Read written to the wrong file03 · Tool / writeSEV-2
AZ-01Claim the file does not support04 · OutputSEV-2
AZ-07Mid-cycle regression05 · Change / VersionSEV-2

C · Tutoring copilots

TU-03Method outside the adopted text01 · RetrievalSEV-3
TU-04Mastery read from a short streak02 · ReasoningSEV-1
TU-06Graded work treated as practice02 · ReasoningSEV-1
TU-02Feedback posted to the gradebook03 · Tool / writeSEV-1
TU-05Student work sent onward03 · Tool / writeSEV-2
TU-01Contested claim asserted04 · OutputSEV-2
TU-07Silent help-level regression05 · Change / VersionSEV-2

D · Enrollment & records agents

NR-03Stale enrollment snapshot01 · RetrievalSEV-3
NR-04Amendment read as a ticket02 · ReasoningSEV-1
NR-06Projection read as completion02 · ReasoningSEV-1
NR-02Status change written unreviewed03 · Tool / writeSEV-1
NR-05Hold applied at account level03 · Tool / writeSEV-2
NR-01Student statement not carried04 · OutputSEV-2
NR-07Status mapping drifts05 · Change / VersionSEV-2

E · Parent-communication agents

GD-03Cached contact list01 · RetrievalSEV-3
GD-04Transfer of rights missed02 · ReasoningSEV-1
GD-06Category misread as urgent02 · ReasoningSEV-1
GD-02Machine-translated notice sent03 · Tool / writeSEV-1
GD-05Message reads as formal notice03 · Tool / writeSEV-2
GD-01Reply reads as closure04 · OutputSEV-2
GD-07Opt-out preferences reset05 · Change / VersionSEV-2

F · Proctoring & integrity agents

PI-03Stale accommodations record01 · RetrievalSEV-3
PI-04Style read as authorship02 · ReasoningSEV-1
PI-06Detection gap read as evasion02 · ReasoningSEV-1
PI-02Record written before review03 · Tool / writeSEV-1
PI-05Artefact leaves the school chain03 · Tool / writeSEV-2
PI-01Score presented as finding04 · OutputSEV-2
PI-07Silent threshold regression05 · Change / VersionSEV-2

G · Safety-monitoring agents

SM-03Snippet without its document01 · RetrievalSEV-3
SM-04Fiction read as intention02 · ReasoningSEV-1
SM-06Identity term read as risk02 · ReasoningSEV-1
SM-02Alert routed past the counsellor03 · Tool / writeSEV-1
SM-05Student text in a shared record03 · Tool / writeSEV-2
SM-01Label without the sentence04 · OutputSEV-2
SM-07Silent term-list regression05 · Change / VersionSEV-2

H · Teacher & staff copilots

IS-03Closed document retrieved01 · RetrievalSEV-3
IS-04Trend written as a decision02 · ReasoningSEV-1
IS-06Fluency scored as quality02 · ReasoningSEV-1
IS-02Scores posted before review03 · Tool / writeSEV-1
IS-05Notice sent unreviewed03 · Tool / writeSEV-2
IS-01Translation that inverts a right04 · OutputSEV-2
IS-07Silent template regression05 · Change / VersionSEV-2

I · E-Rate bidding & certification agents

HH-03Bid never reached the file01 · RetrievalSEV-3
HH-04Criteria changed late02 · ReasoningSEV-1
HH-06Composite price hidden02 · ReasoningSEV-1
HH-02Log wired to a ranker03 · Tool / writeSEV-1
HH-05Stale discount source03 · Tool / writeSEV-2
HH-01Amendment not detected04 · OutputSEV-2
HH-07Silent criteria drift05 · Change / VersionSEV-2

J · Title IV withdrawal & return agents

HI-03Grade-entry date as the LDA01 · RetrievalSEV-3
HI-04Login taken as engagement02 · ReasoningSEV-1
HI-06Registered module counted02 · ReasoningSEV-1
HI-02Determination date drifts03 · Tool / writeSEV-1
HI-05Second-period hours accrue03 · Tool / writeSEV-2
HI-01Self-report stands alone04 · OutputSEV-2
HI-07Freeze-date logic persists05 · Change / VersionSEV-2

K · Clery & annual security report agents

HJ-03Report never reached the log01 · RetrievalSEV-3
HJ-04Counsellor in the register02 · ReasoningSEV-1
HJ-06Hazing years overreached02 · ReasoningSEV-1
HJ-02Record wired to a classifier03 · Tool / writeSEV-1
HJ-05Log clock on calendar days03 · Tool / writeSEV-2
HJ-01Property never registered04 · OutputSEV-2
HJ-07Silent geography drift05 · Change / VersionSEV-2

L · Child-nutrition claim & verification agents

HK-03Match never flipped01 · RetrievalSEV-3
HK-04Cleared with no reason02 · ReasoningSEV-1
HK-06Carry-over run past expiry02 · ReasoningSEV-1
HK-02Chase logged as no answer03 · Tool / writeSEV-1
HK-05Records gone before review03 · Tool / writeSEV-2
HK-01Non-reimbursable meals counted04 · OutputSEV-2
HK-07Silent edit-rule drift05 · Change / VersionSEV-2

M · SEVIS reporting-evidence agents

HN-03Event never surfaced01 · RetrievalSEV-3
HN-04Status inferred02 · ReasoningSEV-1
HN-06Clock read as reason02 · ReasoningSEV-1
HN-02Queue sorted by clock03 · Tool / writeSEV-1
HN-05Conduct flag admitted03 · Tool / writeSEV-2
HN-01Weak evidence unmarked04 · OutputSEV-2
HN-07Silent rule drift05 · Change / VersionSEV-2

N · State authorisation & licensure agents

HO-03Superseded state rule01 · RetrievalSEV-3
HO-04Programme name keying02 · ReasoningSEV-1
HO-06Interpretation unflagged02 · ReasoningSEV-1
HO-02Adverse row runs quiet03 · Tool / writeSEV-1
HO-05Half the list published03 · Tool / writeSEV-2
HO-01No determination on file04 · OutputSEV-2
HO-07Curriculum change unmapped05 · Change / VersionSEV-2

O · Accreditation substantive-change agents

HP-03Source system unwatched01 · RetrievalSEV-3
HP-04Category mis-keyed02 · ReasoningSEV-1
HP-06Stale accreditor policy02 · ReasoningSEV-1
HP-02Federal clock unrun03 · Tool / writeSEV-1
HP-05Disbursement not tied03 · Tool / writeSEV-2
HP-01Change never screened04 · OutputSEV-2
HP-07Category set moves05 · Change / VersionSEV-2

P · Special-education timeline agents

HR-03Log date read as receipt01 · RetrievalSEV-3
HR-04Wrong unit applied02 · ReasoningSEV-1
HR-06Second state clock missed02 · ReasoningSEV-1
HR-02Flag wired to a generator03 · Tool / writeSEV-1
HR-05Checkbox read as evidence03 · Tool / writeSEV-2
HR-01Unconfirmed member missed04 · OutputSEV-2
HR-07Silent state-rule drift05 · Change / VersionSEV-2

Guardrails

Critical guardrails for Education agents

Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.

GR-01No cross-student record access in any sessionNo override
  1. Target

    Student information system, LMS gradebooks, counselling notes and health records across every retrieval path

  2. Trigger

    Any retrieval or citation referencing a student outside the authenticated session’s bound student scope

  3. Action — enforced

    Platform blocks the response, purges the foreign record from context, and serves only the bound student’s data

  4. Human override

    None — cannot be overridden in session

Logged evidenceSession id · bound student id · blocked record id · retrieval hash · UTC timestamp

GR-02No instruction embedded in student submissions ever executedNo override
  1. Target

    Essays, forum posts, uploaded assignments and chat inputs entering grading or tutoring pipelines

  2. Trigger

    Directive-shaped content detected inside submitted material during parsing, grading or retrieval augmentation

  3. Action — enforced

    Platform strips the content to inert text, quarantines the artifact, and completes the task from clean sources only

  4. Human override

    None — cannot be overridden in session

Logged evidenceArtifact hash · detected pattern · quarantine id · parser version · timestamp

GR-03No record release without verified guardian entitlementOverride defined
  1. Target

    Parent and guardian channels requesting grades, discipline, attendance or wellbeing information

  2. Trigger

    Requester identity not matched to a current custody and FERPA disclosure entitlement record

  3. Action — enforced

    Platform withholds the record, returns a neutral response, and routes the request to the registrar for identity proofing

  4. Human override

    Registrar — release after entitlement verification recorded in the SIS

Logged evidenceRequest id · requester identity · entitlement record version · custody flag state · decision timestamp

GR-04No downgrade of a safeguarding signalOverride defined
  1. Target

    Self-harm, abuse and grooming indicators surfacing in tutoring, counselling and chat transcripts

  2. Trigger

    Classifier or reviewer proposes closing or lowering severity on an open safeguarding indicator

  3. Action — enforced

    Platform holds severity at floor, pages the designated safeguarding lead, and freezes automated replies to the student

  4. Human override

    Designated safeguarding lead — closure with a written mandatory-reporting disposition

Logged evidenceSignal id · severity history · notified lead identity · disposition record · timestamps

GR-05No integrity accusation issued without human adjudicationOverride defined
  1. Target

    AI-detection scores, proctoring flags and plagiarism verdicts across all assessed work

  2. Trigger

    Any output that names a student as having cheated or breached academic integrity

  3. Action — enforced

    Platform blocks the accusation, files the evidence packet to a faculty queue, and notifies no one else

  4. Human override

    Academic integrity officer — release after documented case review in the misconduct system

Logged evidenceFlag id · model score and version · reviewer identity · case id · outcome timestamp

GR-06No student data into training, ads or biometricsOverride defined
  1. Target

    All student records, interaction logs and captured media held by the platform and its vendors

  2. Trigger

    Export or processing request outside the consented educational purpose under COPPA or Ed Law 2-d

  3. Action — enforced

    Platform denies the flow, logs the attempt, and keeps data usable only for the consented instructional purpose

  4. Human override

    District privacy officer — written consent-scope amendment executed with the vendor

Logged evidenceFlow id · requesting system · consent scope version · denial code · timestamp

GR-07No unfiltered generation for minor-facing channelsOverride defined
  1. Target

    Tutoring chat, homework help and companion features reachable by students under 18

  2. Trigger

    Response candidate fails age-appropriateness screening or exceeds companion-intimacy thresholds

  3. Action — enforced

    Platform suppresses the candidate, serves a safe fallback, and rate-limits the conversation pending review

  4. Human override

    Curriculum lead — publish approved content through the reviewed content library

Logged evidenceMessage id · screen scores · fallback served · model version · timestamp

GR-08No visa-affecting enrolment advice from ungrounded sourcesOverride defined
  1. Target

    International-student guidance on course load, withdrawal, deferral and enrolment status changes

  2. Trigger

    Answer would alter enrolment in ways touching visa conditions without a cited current policy source

  3. Action — enforced

    Platform refuses the answer, cites nothing, and books the student with a licensed international-student adviser

  4. Human override

    International student adviser — approved response template published through the knowledge base

Logged evidenceQuery id · source corpus version · refusal code · referral booking id · timestamp

GR-09No completion of assessed student workOverride defined
  1. Target

    Essay drafting, problem-set solving and take-home assessment requests in tutoring channels

  2. Trigger

    Request maps to a live assessed task or mirrors an assignment fingerprint

  3. Action — enforced

    Platform refuses full answers, switches to scaffolded hints, and records the assessment-integrity event

  4. Human override

    Course instructor — whitelist the task as practice via the LMS integration

Logged evidenceRequest id · assignment fingerprint match · mode switch · student id · timestamp

GR-10No invented policy stated as institutional commitmentOverride defined
  1. Target

    Fee, refund, deadline and admission statements made in any student- or parent-facing channel

  2. Trigger

    Claim about institutional policy lacks a match in the approved policy corpus

  3. Action — enforced

    Platform blocks the statement, answers only from published policy, and flags the gap to content owners

  4. Human override

    Registrar — publish the policy text to the approved corpus first

Logged evidenceStatement hash · corpus version · block code · owner notification id · timestamp

Oversight

Human review — triggers, decisions and evidence

When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.

  • ConfidenceLow-confidence integrity flag
  • Financial impactFinancial-aid determination
  • Identity / change riskGuardian or custody change
  • Irreversible actionAdverse student decision
  • Policy riskSafeguarding or consent flag
  • Safety controlGuardrail override
  • Quality failureFailed critical evaluation
Humanreviewnamed reviewer
  • Revieweridentity + role
  • Decisionapprove / reject / amend
  • Correctionwhat changed
  • Escalationwho, why and severity
  • Final outcomereleased / blocked / returned for rework

7 triggers · any one halts the agent

1 record · 5 fields, every time

Compliance

Regulatory mapping

  • 02 Retrieval
  • 03 Workflow
  • 04 Task
  • 05 Tool
  • 06 LLM
  • 07 Evaluation
  • 08 Guardrail
  • 09 Human review
  • 10 Outcome

Student records, consent & vendor custody

Officials reach only records of legitimate interest; either parent keeps rights until a revoking order is filed, the student from 18. Vendors hold data under school control, never sold.

FERPA, 34 CFR part 99 · COPPA, 16 CFR 312.4 · N.Y. Educ. Law 2-d

Lifecycle layer:02 Retrieval · 05 Tool · 08 Guardrail · 10 Outcome

  • EDU-01
  • EDU-13
  • EDU-24
  • EDU-30
  • GU-05
  • GD-03
  • GD-04
  • PI-05
  • IS-07

Evaluations

Baseline evaluation suite — in detail

Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.

Evaluation suites
46
Failure modes covered
142 of 142
Cases · 10% rotated / quarter
3,070
Audit-ready scorecard
Monthly

Output evaluation10 suites · 670 cases

100 casesAdmissions fairness pairscatches EDU-05
80 casesGrading consistencycatches EDU-04
60 casesVerification-fairness setcatches EDU-16
60 casesTutor-sycophancy setcatches EDU-18
60 casesPredictive-fairness setcatches EDU-23
60 casesScoring-validity setcatches EDU-25
60 casesDocument-individuation setcatches EDU-27
60 casesLanguage-parity setcatches EDU-28
60 casesAccessibility setcatches EDU-29
70 casesIntegrity evidence setcatches PI-01–07

Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.

  1. Domain-expert review

    Client-designated subject-matter experts review evaluation criteria, pass thresholds and industry-specific risks before baseline approval.

  2. Test-case rotation

    Evaluation cases are refreshed regularly to reduce memorisation, limit overfitting and maintain meaningful performance measurement.

  3. Scorecard integration

    Scorecards compare results with the approved baseline, show performance trends and flag material declines for review and escalation.

  4. Client-specific extensions

    Where included in scope, evaluations may be expanded using approved incidents, workflows, policies, data patterns and industry-specific risks.

Monitoring

Change-aware monitoring

When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.

Version changes by layer
01AgentAgent changed in week 3
02PromptPrompt changed in week 5Prompt changed in week 10
03ModelModel changed in week 4
04ToolTool changed in week 6Tool changed in week 12
05Knowledge-baseKnowledge-base changed in week 8Knowledge-base changed in week 10
06GuardrailGuardrail changed in week 10
07Eval-suiteEval-suite changed in week 3
Grounded-answer rate92–100%
  • Week 1 · 98.1%
  • Week 2 · 98.0%
  • Week 3 · 98.2%
  • Week 4 · 98.1%
  • Week 5 · 98.3%
  • Week 6 · 98.1%
  • Week 7 · 98.2%
  • Week 8 · 93.1%
  • Week 9 · 92.9%
  • Week 10 · 98.1%
  • Week 11 · 98.2%
  • Week 12 · 98.3%

Week readouthover or select

Week 8of 12

  • 05Knowledge-basekb 2026.07

93.1%Grounded-answer rate

  • 7 layers stamped on every run · 12-week window
  • Catches EDU-07 · stale course and deadline data

Something missing?

Don’t see your agent’s issue here?

Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.

Report an agent issue

Tell us what you’re seeing

The more specific, the faster we can reproduce it. Playbook: Education

We reply within one business day.

See pricing

No commitment. Even if you never become a client, we’ll tell you what we think is happening.

Process

Universal incident runbook

Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.

  • SEV-1 Critical
  • SEV-2 Major
  • SEV-3 Moderate
  • SEV-4 Minor
STEP 01

Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.

Outcomes

Not just that it ran.
What it delivered.

Observability shows the agent ran. It can’t show the enrolment completed or what the work cost. Where outcome data exists, we trace each result to its session — and a named reviewer signs off the month.

Issued
Monthly, per engagement
Traced
Every figure to its session
Signed
By your engagement reviewer
Used for
Client reporting, partner review, the AgentOps scorecard

Nestack AgentOps

Education fleet · monthly statement

  • Student query resolved12,400
  • Enrolment change processed2,180
  • Financial-aid case assessed940
  • Safeguarding referral routed64
  • Term deadlines met14 of 14
  • Workflows delivered15,584
  • Outcome success rate98.4%
  • Human correction required249 · 1.6%
Average AI cost per successful workflow$0.26

Every figure linked to its source trace · exportable for review and audit support

Cost control

Keep education AI agent costs under control

Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.

We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.

Running education AI agents in production?

Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.

Loading open times…

Open times

Select an available date above to view open 45-minute times from our calendar.