{"resourceId":"arkansas-tech-ai-guiding-principles-agentic-approval-20261014","versions":[{"version":"external-2f1dfd174539173c3fc31b570154ef23d73db6a22ae68e9bc2d5c68e0e37b594","resource":{"id":"arkansas-tech-ai-guiding-principles-agentic-approval-20261014","title":"Arkansas Tech adopts AI principles requiring explicit approval, a named owner and re-review for any agentic AI connection, including vendor agent features switched on by default","organization":"Arkansas Tech University","sector":"Public regional university: institutional AI governance","geography":"Russellville, Arkansas, United States","publishedAt":"14 October 2026 (document header 'ATU AI Guiding Principles – 10.14.26')","publicationDate":"2026-10-14","eventDate":"2026-10-14","sourceName":"Arkansas Tech University","sourceLabel":"Institutional AI governance document","sourceUrl":"https://www.atu.edu/ai/docs/GUIDING%20PRINCIPLES_FINAL20261012.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["developers-agents","governance-procurement","data-security","accessibility-workforce"],"finding":"Arkansas Tech's AI Guiding Principles, developed by a faculty, staff and student committee, set ten principles and governance standards. AI may not be the final decision-maker for admissions, financial aid, grading, discipline, employment or access to services, and ATU will not require employees to use generative AI. Agentic AI gets its own tier: any connection to ATU systems, accounts or data needs explicit approval through governance including the information security office, a named owner, a statement of what it can access and do, when humans approve actions and what records are kept. Vendor agentic features turning on by default trigger re-review. ATU will keep an AI inventory and retire noncompliant systems.","sledRelevance":"Why now: not previously archived and surfaced in this run's scrutiny pass; it is a concrete institutional answer to the agent-governance and labor demands raised this week, including a no-mandatory-use commitment that unions elsewhere are seeking in contracts.","evidence":"Approved principles document; describes intended controls, not observed practice.","architectureImplications":"Agent connections must use approved sign-in and least-privilege access; credentials may not be shared with third-party services.","governanceImplications":"Per-tool, per-use approval for agents with named owner, access scope, human approval points and recordkeeping; re-review on capability changes.","securityPrivacyImplications":"Least-privilege access, no credential sharing, MFA hygiene, vendor contract terms on retention, breach notice and subcontractors.","caveats":"Dated 14 October, a week before this run; specific procedures and approved-tools list are still to come.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: Arkansas Tech now requires explicit approval, a named owner and re-review for every agentic AI connection, including vendor features enabled by default. Interpretation: institutions adopting similar rules will need an intake process, inventory and vendor-change monitoring to make them workable. Offer a bounded agent intake and inventory setup. Do not claim the principles are enforced or effective; they are newly adopted and procedures are pending.","engineering":"Engineering framing: ATU's standard asks each agent approval to state what it can access and do, when humans must approve actions and what records are kept. Interpretation: pre-sales should map candidate tools against those fields, confirm they support approved sign-in and least-privilege scopes, and check whether vendors notify customers before enabling agentic features by default, since that change triggers re-review under ATU's rules.","delivery":"Delivery framing: principles become real only with an intake workflow, an inventory and a review trigger. Interpretation: delivery should build a single agent request form capturing owner, scope, human approval points and logging, keep a live inventory, and watch vendor release notes for agent features turned on by default. ATU also bars mandatory generative AI use for employees, so rollout plans must keep non-AI paths available."},"roleDetails":{"sales":{"customerProblem":"Institutions adopting agent-specific governance need practical intake, inventory and vendor-change monitoring to apply it.","stakeholders":["CIO and information security office","Provost","HR","Faculty and staff senates","Procurement"],"discoveryQuestions":["How will agent approvals be requested and recorded?","Who monitors vendor releases for default-on agent features?","Is there an AI inventory today?","How is the no-mandatory-use rule handled in workflows?"],"valueHypothesis":"Interpretation: a standard intake and inventory could make agent approvals consistent; no outcomes are documented.","potentialEngagement":"A bounded agent intake, inventory and vendor-change monitoring setup aligned with an institution's AI principles.","unsupportedClaims":["That the principles are enforced","Reduced incidents","Faster approvals","Guaranteed savings"]},"engineering":{"fit":"Template for agent-specific approval criteria in a campus governance framework.","architectureIntegration":"Approved agent connections must use security-office-approved authentication and least-privilege access.","prerequisites":["Agent intake form with access scope","Identity provider support for scoped access","Action logging"],"constraints":["Per-tool, per-use approval","Re-review when vendors enable agent features","No credential sharing with third parties"],"security":"Least-privilege access, MFA hygiene, vendor contract terms for retention, deletion and breach notice.","proofOfValue":["Confirm each agent's scopes match its approval","Verify action logs capture what the agent did","Test detection of vendor default-on agent features"]},"delivery":{"work":"Operationalize agent approvals, inventory and re-review under new AI principles.","dependencies":["Governance group meeting cadence","Vendor release monitoring","Inventory tooling"],"ownership":"Office of Information Systems with the relevant governance group; each agent has a named responsible owner.","skillsAdoption":"Role-appropriate training required before high-impact systems are deployed.","governanceCheckpoints":["Approval before any agent connects to ATU systems","Re-review on capability change","Periodic inventory review and sunset"],"acceptanceCriteria":["Proposed: 100% of connected agents in the inventory with named owners","Proposed: re-review completed within a set period of vendor feature changes","Proposed: non-AI alternatives documented for required workflows"],"risks":["Shadow agents bypassing approval","Vendor features enabled silently","Approval backlog slowing legitimate use"]}},"retrievedAt":"2026-10-22T21:55:03-05:00","enrichedAt":"2026-10-22T21:58:32-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No required generative AI use for employees; AI not to justify eliminating human oversight or services.","procurementImplications":"Vendor contracts must cover data handling, deletion, breach notification and material changes; conflict-of-interest disclosure for AI purchasers.","operatingModelImplications":"Inventory, monitoring and sunset of AI systems; role-appropriate training before high-impact deployment.","sourceVerification":{"openedUrl":"https://www.atu.edu/ai/docs/GUIDING%20PRINCIPLES_FINAL20261012.pdf","referenceExcerpt":"Any agentic AI connection to ATU systems or accounts requires explicit approval through ATU's governance process","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}