Student Worker and TA AI Use Policy: What to Include

Why This Requires an Operational Policy, Not an Ethics Statement

Student workers and teaching assistants are already using AI tools for grading support, tutoring, research assistance, and administrative work, often without any document that defines what is allowed. A general statement encouraging responsible AI use does not tell a TA whether they can paste student submissions into a chatbot, or tell an IT administrator which tools are authorized to connect to the gradebook. The gap institutions face is not a values gap; it is an operational one. The policy needs to function as a governance document that makes specific decisions about scope, data access, tool approval, and enforcement, because those are the areas where FERPA exposure, academic integrity failures, and unmanaged system access actually occur.

Defining Scope: Who and What the Policy Covers

Scope decisions come first. The policy must specify which categories of student workers it applies to (graduate TAs, undergraduate graders, work-study administrative staff) and which systems fall within its boundary, including the LMS, gradebook, tutoring platforms, and any tool that connects to them. Because data exposure risk depends on integration points rather than the AI tool alone, the policy should map which systems student workers are permitted to connect AI tools to, rather than treating AI use as a single undifferentiated activity. Institutions also need to decide whether this policy stands alone or amends existing student employee handbooks and FERPA confidentiality agreements, since that decision affects how enforceable the policy is in practice.

Permitted and Prohibited AI Use by Task

Blanket approval or prohibition of AI use is not specific enough to govern actual behavior. The policy should define rules at the task level:

• AI-assisted feedback drafting on student work is a different risk category than AI autonomously assigning final grades.
• Using AI to help draft tutoring explanations differs from an AI tool generating and releasing answer keys.
• AI-supported literature searches differ from AI tools drafting original research analysis submitted as a student worker's own output.

Where AI has materially contributed to grading, feedback, or instructional content a student receives, the policy should require disclosure or attribution so students understand how their work was evaluated or supported.

FERPA and Student Data Handling Requirements

Student workers and TAs who access education records as part of their duties are generally treated as school officials under FERPA's 34 CFR §99.31(a)(1) exception, which means the institution, not the individual student worker, bears legal responsibility for compliance. That exception only applies if the institution maintains direct control over how the party accessing the records uses and maintains them.

FERPA is technology-neutral: it governs the data itself regardless of whether it moves through a spreadsheet, an LMS, or an AI tool. Applying the school-official exception to an AI system therefore requires the institution to demonstrate contractual and technical control over that tool's data handling, something that is not possible with unmanaged consumer-grade AI applications. The policy should explicitly restrict which categories of student data, including grades, disability accommodation records, and disciplinary records, may be entered into any AI tool, sanctioned or otherwise.

Tool Approval, Oversight, and Where Written Policy Falls Short

Because FERPA compliance status differs materially between institutionally approved tools and unmanaged consumer applications, the policy needs a maintained inventory or approval list rather than a general reference to AI tools. Institutions must also decide whether approved tools require centralized authentication, such as single sign-on provisioning, versus ad hoc individual sign-up, since centralized provisioning is what allows an institution to demonstrate direct control under FERPA.

Enforcement also needs explicit ownership. Student workers may fall under student employment structures, academic conduct processes, or both, and the policy should state which office handles a violation rather than leaving it ambiguous across IT, HR, and academic affairs.

It is worth stating plainly that a written policy cannot, by itself, verify that student workers are following it. Confirming compliance requires technical controls such as access logging, restrictions on unauthorized tool use, and monitoring of what AI tools are actually connecting to institutional systems. This is the layer where runtime governance and agent-level oversight become relevant as a complement to written policy rather than a replacement for it. Capability areas that matter here include tool approval workflows, access logging, and least-privilege permissions for AI agents.