EducationManaged AI Agents
Education AI Agents,
Monitored for Accuracy
Nestack Agent Care helps education providers monitor, evaluate, and optimize AI agents used for tutoring, grading, student support, and content generation — before small AI errors become accuracy or safeguarding issues.
Scope
Education AI agents we build & manage
Students & families4
Classroom & campus4
Enrollment & accreditation4
Funding & reporting4
Observability
What we make observable
Every education agent session is traced across ten layers — what we capture and the evidence we keep.
- Evidence we keepGoalconstraintsapproval requirement
- Evidence we keepSourceversiontimestamprelevancecitation
- Evidence we keepPlanned sequenceactual sequenceworkflow status
- Evidence we keepTask statusresultretryfailure reason
- Evidence we keepTool nameversioninputoutputpermissionresult
- Evidence we keepModel/versioninput/outputtoken usagelatencycost
- Evidence we keepEvaluation typemetricthresholdresult
- Evidence we keepGuardrail targettriggeractionenforcement result
- Evidence we keepReviewerdecisioncorrectionreason
- Evidence we keepOutcome statusbusiness resultlinked trace
Catalog
Failure modes
Filter failure modes by where they occur in the agent lifecycle—from goals and retrieval to tools, evaluations, guardrails and outcomes.
EDU-01Student-record privacy leaks — grades, discipline, health to unauthorized partiesSEV-1
EDU-02Safeguarding signals missed — self-harm, abuse, grooming disclosuresSEV-1
EDU-03Wrong academic guidance — credits, prerequisites, visa-affecting load changesSEV-2
EDU-04Grading assistance bias or inconsistencySEV-2
EDU-05Admissions discrimination via proxiesSEV-1
EDU-06False academic-integrity accusations — AI-detection overreachSEV-2
EDU-07Stale course, fee or deadline dataSEV-3
EDU-08Injection via student submissions and forum postsSEV-2
EDU-09Academic-integrity undermining — completing assessed work for studentsSEV-2
EDU-10Accommodation misadvice — IEP/504 supports missed or disability disclosedSEV-1
EDU-11Financial-aid and scholarship miscalculation — eligibility and amountsSEV-2
EDU-12Curriculum content errors — wrong facts or biased explanations in tutoringSEV-2
EDU-13Custody and guardian-boundary errors — info released to wrong parentSEV-1
EDU-14Age-inappropriate or harmful content reaching minorsSEV-1
EDU-15Proctoring false-cheating flags — behavioral telemetry misread at scaleSEV-2
EDU-16Identity-verification bias — face detection and behavior models failing protected groupsSEV-1
EDU-17Safety-surveillance false flags — police dispatch, discipline, protected-trait outingSEV-1
EDU-18Sycophantic tutoring — wrong answers validated, right answers overturnedSEV-2
EDU-19Overreliance scaffolding failure — answer-giving that masks learning lossSEV-2
EDU-20Companion drift — parasocial attachment and displaced help-seekingSEV-1
EDU-21Dead-end automation — adverse actions with no human escalation pathSEV-1
EDU-22Unauthorized commitments — invented policies that bind the institutionSEV-2
EDU-23Predictive-label harm — biased risk scores steering studentsSEV-2
EDU-24Consent-boundary violations — student data into training, ads or biometricsSEV-1
EDU-25Autograder validity collapse — proxy scoring gamed or skewedSEV-2
EDU-26Hallucinated citations and sources in research supportSEV-3
EDU-27Boilerplate formal documents — IEPs, recommendation letters, crisis commsSEV-2
EDU-28Language-inconsistency — answers differ across languages and translationsSEV-2
EDU-29Accessibility failures — assistive-tech breakage and caption inaccuracySEV-2
EDU-30Vendor-custody failure — collapse, breach or orphaned student dataSEV-1
A · Student-support & advising agents
GU-03Superseded source quoted01 · RetrievalSEV-3
GU-04General rule read onto one student02 · ReasoningSEV-1
GU-06Course-load advice to a visa holder02 · ReasoningSEV-1
GU-02Registration touched, not explained03 · Tool / writeSEV-1
GU-05Disclosure written to a shared note03 · Tool / writeSEV-2
GU-01Answer without a source04 · OutputSEV-2
GU-07Silent policy regression05 · Change / VersionSEV-2
B · Admissions assistants
AZ-03Unredacted file retrieved01 · RetrievalSEV-3
AZ-04Race rebuilt from proxies02 · ReasoningSEV-1
AZ-06Judgement turned into a formula02 · ReasoningSEV-1
AZ-02Disability note written to record03 · Tool / writeSEV-1
AZ-05Read written to the wrong file03 · Tool / writeSEV-2
AZ-01Claim the file does not support04 · OutputSEV-2
AZ-07Mid-cycle regression05 · Change / VersionSEV-2
C · Tutoring copilots
TU-03Method outside the adopted text01 · RetrievalSEV-3
TU-04Mastery read from a short streak02 · ReasoningSEV-1
TU-06Graded work treated as practice02 · ReasoningSEV-1
TU-02Feedback posted to the gradebook03 · Tool / writeSEV-1
TU-05Student work sent onward03 · Tool / writeSEV-2
TU-01Contested claim asserted04 · OutputSEV-2
TU-07Silent help-level regression05 · Change / VersionSEV-2
D · Enrollment & records agents
NR-03Stale enrollment snapshot01 · RetrievalSEV-3
NR-04Amendment read as a ticket02 · ReasoningSEV-1
NR-06Projection read as completion02 · ReasoningSEV-1
NR-02Status change written unreviewed03 · Tool / writeSEV-1
NR-05Hold applied at account level03 · Tool / writeSEV-2
NR-01Student statement not carried04 · OutputSEV-2
NR-07Status mapping drifts05 · Change / VersionSEV-2
E · Parent-communication agents
GD-03Cached contact list01 · RetrievalSEV-3
GD-04Transfer of rights missed02 · ReasoningSEV-1
GD-06Category misread as urgent02 · ReasoningSEV-1
GD-02Machine-translated notice sent03 · Tool / writeSEV-1
GD-05Message reads as formal notice03 · Tool / writeSEV-2
GD-01Reply reads as closure04 · OutputSEV-2
GD-07Opt-out preferences reset05 · Change / VersionSEV-2
F · Proctoring & integrity agents
PI-03Stale accommodations record01 · RetrievalSEV-3
PI-04Style read as authorship02 · ReasoningSEV-1
PI-06Detection gap read as evasion02 · ReasoningSEV-1
PI-02Record written before review03 · Tool / writeSEV-1
PI-05Artefact leaves the school chain03 · Tool / writeSEV-2
PI-01Score presented as finding04 · OutputSEV-2
PI-07Silent threshold regression05 · Change / VersionSEV-2
G · Safety-monitoring agents
SM-03Snippet without its document01 · RetrievalSEV-3
SM-04Fiction read as intention02 · ReasoningSEV-1
SM-06Identity term read as risk02 · ReasoningSEV-1
SM-02Alert routed past the counsellor03 · Tool / writeSEV-1
SM-05Student text in a shared record03 · Tool / writeSEV-2
SM-01Label without the sentence04 · OutputSEV-2
SM-07Silent term-list regression05 · Change / VersionSEV-2
H · Teacher & staff copilots
IS-03Closed document retrieved01 · RetrievalSEV-3
IS-04Trend written as a decision02 · ReasoningSEV-1
IS-06Fluency scored as quality02 · ReasoningSEV-1
IS-02Scores posted before review03 · Tool / writeSEV-1
IS-05Notice sent unreviewed03 · Tool / writeSEV-2
IS-01Translation that inverts a right04 · OutputSEV-2
IS-07Silent template regression05 · Change / VersionSEV-2
I · E-Rate bidding & certification agents
HH-03Bid never reached the file01 · RetrievalSEV-3
HH-04Criteria changed late02 · ReasoningSEV-1
HH-06Composite price hidden02 · ReasoningSEV-1
HH-02Log wired to a ranker03 · Tool / writeSEV-1
HH-05Stale discount source03 · Tool / writeSEV-2
HH-01Amendment not detected04 · OutputSEV-2
HH-07Silent criteria drift05 · Change / VersionSEV-2
J · Title IV withdrawal & return agents
HI-03Grade-entry date as the LDA01 · RetrievalSEV-3
HI-04Login taken as engagement02 · ReasoningSEV-1
HI-06Registered module counted02 · ReasoningSEV-1
HI-02Determination date drifts03 · Tool / writeSEV-1
HI-05Second-period hours accrue03 · Tool / writeSEV-2
HI-01Self-report stands alone04 · OutputSEV-2
HI-07Freeze-date logic persists05 · Change / VersionSEV-2
K · Clery & annual security report agents
HJ-03Report never reached the log01 · RetrievalSEV-3
HJ-04Counsellor in the register02 · ReasoningSEV-1
HJ-06Hazing years overreached02 · ReasoningSEV-1
HJ-02Record wired to a classifier03 · Tool / writeSEV-1
HJ-05Log clock on calendar days03 · Tool / writeSEV-2
HJ-01Property never registered04 · OutputSEV-2
HJ-07Silent geography drift05 · Change / VersionSEV-2
L · Child-nutrition claim & verification agents
HK-03Match never flipped01 · RetrievalSEV-3
HK-04Cleared with no reason02 · ReasoningSEV-1
HK-06Carry-over run past expiry02 · ReasoningSEV-1
HK-02Chase logged as no answer03 · Tool / writeSEV-1
HK-05Records gone before review03 · Tool / writeSEV-2
HK-01Non-reimbursable meals counted04 · OutputSEV-2
HK-07Silent edit-rule drift05 · Change / VersionSEV-2
M · SEVIS reporting-evidence agents
HN-03Event never surfaced01 · RetrievalSEV-3
HN-04Status inferred02 · ReasoningSEV-1
HN-06Clock read as reason02 · ReasoningSEV-1
HN-02Queue sorted by clock03 · Tool / writeSEV-1
HN-05Conduct flag admitted03 · Tool / writeSEV-2
HN-01Weak evidence unmarked04 · OutputSEV-2
HN-07Silent rule drift05 · Change / VersionSEV-2
N · State authorisation & licensure agents
HO-03Superseded state rule01 · RetrievalSEV-3
HO-04Programme name keying02 · ReasoningSEV-1
HO-06Interpretation unflagged02 · ReasoningSEV-1
HO-02Adverse row runs quiet03 · Tool / writeSEV-1
HO-05Half the list published03 · Tool / writeSEV-2
HO-01No determination on file04 · OutputSEV-2
HO-07Curriculum change unmapped05 · Change / VersionSEV-2
O · Accreditation substantive-change agents
HP-03Source system unwatched01 · RetrievalSEV-3
HP-04Category mis-keyed02 · ReasoningSEV-1
HP-06Stale accreditor policy02 · ReasoningSEV-1
HP-02Federal clock unrun03 · Tool / writeSEV-1
HP-05Disbursement not tied03 · Tool / writeSEV-2
HP-01Change never screened04 · OutputSEV-2
HP-07Category set moves05 · Change / VersionSEV-2
P · Special-education timeline agents
HR-03Log date read as receipt01 · RetrievalSEV-3
HR-04Wrong unit applied02 · ReasoningSEV-1
HR-06Second state clock missed02 · ReasoningSEV-1
HR-02Flag wired to a generator03 · Tool / writeSEV-1
HR-05Checkbox read as evidence03 · Tool / writeSEV-2
HR-01Unconfirmed member missed04 · OutputSEV-2
HR-07Silent state-rule drift05 · Change / VersionSEV-2
Guardrails
Critical guardrails for Education agents
Ten controls that hold regardless of prompt, plan or pressure. Open one to see what it protects, what trips it, what the agent is forced to do, who may release it, and what is written to the record.
GR-01No cross-student record access in any sessionNo override
Target
Student information system, LMS gradebooks, counselling notes and health records across every retrieval path
Trigger
Any retrieval or citation referencing a student outside the authenticated session’s bound student scope
Action — enforced
Platform blocks the response, purges the foreign record from context, and serves only the bound student’s data
Human override
None — cannot be overridden in session
Logged evidenceSession id · bound student id · blocked record id · retrieval hash · UTC timestamp
GR-02No instruction embedded in student submissions ever executedNo override
Target
Essays, forum posts, uploaded assignments and chat inputs entering grading or tutoring pipelines
Trigger
Directive-shaped content detected inside submitted material during parsing, grading or retrieval augmentation
Action — enforced
Platform strips the content to inert text, quarantines the artifact, and completes the task from clean sources only
Human override
None — cannot be overridden in session
Logged evidenceArtifact hash · detected pattern · quarantine id · parser version · timestamp
GR-03No record release without verified guardian entitlementOverride defined
Target
Parent and guardian channels requesting grades, discipline, attendance or wellbeing information
Trigger
Requester identity not matched to a current custody and FERPA disclosure entitlement record
Action — enforced
Platform withholds the record, returns a neutral response, and routes the request to the registrar for identity proofing
Human override
Registrar — release after entitlement verification recorded in the SIS
Logged evidenceRequest id · requester identity · entitlement record version · custody flag state · decision timestamp
GR-04No downgrade of a safeguarding signalOverride defined
Target
Self-harm, abuse and grooming indicators surfacing in tutoring, counselling and chat transcripts
Trigger
Classifier or reviewer proposes closing or lowering severity on an open safeguarding indicator
Action — enforced
Platform holds severity at floor, pages the designated safeguarding lead, and freezes automated replies to the student
Human override
Designated safeguarding lead — closure with a written mandatory-reporting disposition
Logged evidenceSignal id · severity history · notified lead identity · disposition record · timestamps
GR-05No integrity accusation issued without human adjudicationOverride defined
Target
AI-detection scores, proctoring flags and plagiarism verdicts across all assessed work
Trigger
Any output that names a student as having cheated or breached academic integrity
Action — enforced
Platform blocks the accusation, files the evidence packet to a faculty queue, and notifies no one else
Human override
Academic integrity officer — release after documented case review in the misconduct system
Logged evidenceFlag id · model score and version · reviewer identity · case id · outcome timestamp
GR-06No student data into training, ads or biometricsOverride defined
Target
All student records, interaction logs and captured media held by the platform and its vendors
Trigger
Export or processing request outside the consented educational purpose under COPPA or Ed Law 2-d
Action — enforced
Platform denies the flow, logs the attempt, and keeps data usable only for the consented instructional purpose
Human override
District privacy officer — written consent-scope amendment executed with the vendor
Logged evidenceFlow id · requesting system · consent scope version · denial code · timestamp
GR-07No unfiltered generation for minor-facing channelsOverride defined
Target
Tutoring chat, homework help and companion features reachable by students under 18
Trigger
Response candidate fails age-appropriateness screening or exceeds companion-intimacy thresholds
Action — enforced
Platform suppresses the candidate, serves a safe fallback, and rate-limits the conversation pending review
Human override
Curriculum lead — publish approved content through the reviewed content library
Logged evidenceMessage id · screen scores · fallback served · model version · timestamp
GR-08No visa-affecting enrolment advice from ungrounded sourcesOverride defined
Target
International-student guidance on course load, withdrawal, deferral and enrolment status changes
Trigger
Answer would alter enrolment in ways touching visa conditions without a cited current policy source
Action — enforced
Platform refuses the answer, cites nothing, and books the student with a licensed international-student adviser
Human override
International student adviser — approved response template published through the knowledge base
Logged evidenceQuery id · source corpus version · refusal code · referral booking id · timestamp
GR-09No completion of assessed student workOverride defined
Target
Essay drafting, problem-set solving and take-home assessment requests in tutoring channels
Trigger
Request maps to a live assessed task or mirrors an assignment fingerprint
Action — enforced
Platform refuses full answers, switches to scaffolded hints, and records the assessment-integrity event
Human override
Course instructor — whitelist the task as practice via the LMS integration
Logged evidenceRequest id · assignment fingerprint match · mode switch · student id · timestamp
GR-10No invented policy stated as institutional commitmentOverride defined
Target
Fee, refund, deadline and admission statements made in any student- or parent-facing channel
Trigger
Claim about institutional policy lacks a match in the approved policy corpus
Action — enforced
Platform blocks the statement, answers only from published policy, and flags the gap to content owners
Human override
Registrar — publish the policy text to the approved corpus first
Logged evidenceStatement hash · corpus version · block code · owner notification id · timestamp
Oversight
Human review — triggers, decisions and evidence
When a defined risk trigger fires, the affected action is routed to a named reviewer. Every decision is recorded with its correction, escalation and final outcome for full traceability.
- ConfidenceLow-confidence integrity flag
- Financial impactFinancial-aid determination
- Identity / change riskGuardian or custody change
- Irreversible actionAdverse student decision
- Policy riskSafeguarding or consent flag
- Safety controlGuardrail override
- Quality failureFailed critical evaluation
- Revieweridentity + role
- Decisionapprove / reject / amend
- Correctionwhat changed
- Escalationwho, why and severity
- Final outcomereleased / blocked / returned for rework
7 triggers · any one halts the agent
1 record · 5 fields, every time
Compliance
Regulatory mapping
- 02 Retrieval
- 03 Workflow
- 04 Task
- 05 Tool
- 06 LLM
- 07 Evaluation
- 08 Guardrail
- 09 Human review
- 10 Outcome
Student records, consent & vendor custody
Officials reach only records of legitimate interest; either parent keeps rights until a revoking order is filed, the student from 18. Vendors hold data under school control, never sold.
FERPA, 34 CFR part 99 · COPPA, 16 CFR 312.4 · N.Y. Educ. Law 2-d
Lifecycle layer:02 Retrieval · 05 Tool · 08 Guardrail · 10 Outcome
- EDU-01
- EDU-13
- EDU-24
- EDU-30
- GU-05
- GD-03
- GD-04
- PI-05
- IS-07
Evaluations
Baseline evaluation suite — in detail
Baseline evaluations are completed during onboarding and repeated based on the selected plan. Agents that fail critical checks remain restricted until they pass re-testing.
- Evaluation suites
- 46
- Failure modes covered
- 142 of 142
- Cases · 10% rotated / quarter
- 3,070
- Audit-ready scorecard
- Monthly
Output evaluation10 suites · 670 cases
60 casesRecords-privacy setcatches EDU-01
100 casesSafeguarding escalationcatches EDU-02
100 casesAcademic-rule groundingcatches EDU-03
100 casesAdmissions fairness pairscatches EDU-05
80 casesGrading consistencycatches EDU-04
60 patternsSubmission injectioncatches EDU-08
70 casesIntegrity-scaffolding setcatches EDU-09
60 casesAccommodation setcatches EDU-10
60 casesFinancial-aid setcatches EDU-11
65 casesCurriculum-content setcatches EDU-12
60 casesGuardian-boundary setcatches EDU-13
60 casesMinor-content-safety setcatches EDU-14
60 casesIntegrity-accusation restraintcatches EDU-06
55 casesCourse-data freshnesscatches EDU-07
60 casesProctoring-flag restraint setcatches EDU-15
60 casesVerification-fairness setcatches EDU-16
60 casesMonitoring-triage setcatches EDU-17
60 casesTutor-sycophancy setcatches EDU-18
60 casesScaffolding-integrity setcatches EDU-19
60 casesCompanion-boundary setcatches EDU-20
60 casesEscalation-path setcatches EDU-21
60 casesCommitment-grounding setcatches EDU-22
60 casesPredictive-fairness setcatches EDU-23
60 casesData-consent setcatches EDU-24
60 casesScoring-validity setcatches EDU-25
60 casesCitation-integrity setcatches EDU-26
60 casesDocument-individuation setcatches EDU-27
60 casesLanguage-parity setcatches EDU-28
60 casesAccessibility setcatches EDU-29
60 casesVendor-custody setcatches EDU-30
70 casesAdvising integrity setcatches GU-01–07
70 casesAdmissions fairness setcatches AZ-01–07
70 casesTutoring boundaries setcatches TU-01–07
70 casesRecords determination setcatches NR-01–07
70 casesFamily notice setcatches GD-01–07
70 casesIntegrity evidence setcatches PI-01–07
70 casesThreat assessment setcatches SM-01–07
70 casesClassroom authority setcatches IS-01–07
70 casesE-Rate fair-bidding integrity setcatches HH-01–07
70 casesReturn-calculation evidence setcatches HI-01–07
70 casesCampus crime statistics compilation setcatches HJ-01–07
70 casesSchool-meal claim and verification setcatches HK-01–07
70 casesStudent-status reporting evidence setcatches HN-01–07
70 casesLicensure-disclosure determination setcatches HO-01–07
70 casesSubstantive-change screening setcatches HP-01–07
70 casesIDEA timeline and team-decision setcatches HR-01–07
Use your work email to unlock the full grid. We use it to send the requested Agent Care material and qualify business inquiries. We do not sell or share your email.
Domain-expert review
Client-designated subject-matter experts review evaluation criteria, pass thresholds and industry-specific risks before baseline approval.
Test-case rotation
Evaluation cases are refreshed regularly to reduce memorisation, limit overfitting and maintain meaningful performance measurement.
Scorecard integration
Scorecards compare results with the approved baseline, show performance trends and flag material declines for review and escalation.
Client-specific extensions
Where included in scope, evaluations may be expanded using approved incidents, workflows, policies, data patterns and industry-specific risks.
Monitoring
Change-aware monitoring
When agent performance changes, Nestack correlates the shift with changes to the agent, prompt, model, tools, knowledge base, guardrails and evaluation suite.
- Week 1 · 98.1%
- Week 2 · 98.0%
- Week 3 · 98.2%
- Week 4 · 98.1%
- Week 5 · 98.3%
- Week 6 · 98.1%
- Week 7 · 98.2%
- Week 8 · 93.1%
- Week 9 · 92.9%
- Week 10 · 98.1%
- Week 11 · 98.2%
- Week 12 · 98.3%
Week readouthover or select
Week 8of 12
- 05Knowledge-basekb 2026.07
93.1%Grounded-answer rate
- 7 layers stamped on every run · 12-week window
- Catches EDU-07 · stale course and deadline data
Something missing?
Don’t see your agent’s issue here?
Every AI environment is different. Share what you’re seeing, and we’ll review the behaviour, assess the risk and recommend the evaluations or controls that may help.
No commitment. Even if you never become a client, we’ll tell you what we think is happening.
Process
Universal incident runbook
Severity is assigned based on business impact, customer harm, data exposure, operational disruption and overall scope.
- SEV-1 Critical
- SEV-2 Major
- SEV-3 Moderate
- SEV-4 Minor
Automated monitoring or human review identifies unusual behaviour. Alerts are recorded and routed according to severity.
Outcomes
Not just that it ran.
What it delivered.
Observability shows the agent ran. It can’t show the enrolment completed or what the work cost. Where outcome data exists, we trace each result to its session — and a named reviewer signs off the month.
- Issued
- Monthly, per engagement
- Traced
- Every figure to its session
- Signed
- By your engagement reviewer
- Used for
- Client reporting, partner review, the AgentOps scorecard
Nestack AgentOps
Education fleet · monthly statement
- Student query resolved12,400
- Enrolment change processed2,180
- Financial-aid case assessed940
- Safeguarding referral routed64
- Term deadlines met14 of 14
- Workflows delivered15,584
- Outcome success rate98.4%
- Human correction required249 · 1.6%
Every figure linked to its source trace · exportable for review and audit support
Cost control
Keep education AI agent costs under control
Token spend is monitored, optimised and reported as part of Agent Care — and savings never come at the expense of quality, because every change is verified against your evaluation baseline.
We review token spend by agent, workflow, model, and session so you can understand where AI costs are coming from.
Running education AI agents in production?
Get a free assessment of one agent. We’ll review its behaviour, run a baseline evaluation and highlight potential risks and performance gaps.
Loading open times…
Open times
Select an available date above to view open 45-minute times from our calendar.
