{"resourceId":"cwru-generative-agentic-ai-policy-safeguards-202610","versions":[{"version":"external-e3f9cf4cdc70bc636bfe05e4e49dd4e9cb37e3491539f2c5de1b99277f75015f","resource":{"id":"cwru-generative-agentic-ai-policy-safeguards-202610","title":"Case Western Reserve's generative and agentic AI policy requires least-privilege identities, full action logging and human checkpoints for agents, and governance review of any AI purchase","organization":"Case Western Reserve University ([U]Tech)","sector":"Private research university: AI policy, information security and procurement controls","geography":"Cleveland, Ohio, United States","publishedAt":"October 2026 (undated PDF in the university's 2026-10 file directory, alongside the 16 October Gemini Enterprise rollout)","publicationDate":null,"eventDate":null,"sourceName":"Case Western Reserve University AI site","sourceLabel":"Institutional policy","sourceUrl":"https://case.edu/ai/sites/default/files/2026-10/Institutional%20Policy%20and%20Guidelines%20on%20Generative%20and%20Agentic%20Artificial%20Intelligence.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["developers-agents","data-security","governance-procurement"],"finding":"CWRU's institutional policy on generative and agentic AI limits consumer AI to public data and lists approved services with their cleared data levels; standard Gemini Enterprise is cleared for internal data including FERPA records, while a restricted-data version is still to be announced. Any AI tool bought with university funds, including department budgets, grants or p-cards, needs AI Governance Committee and information security review, as do internally built RAG pipelines and agents. Approved agentic implementations must use least-privilege identities, log agent actions, queries, tool calls and decisions, and include human checkpoints or hard limits for irreversible or high-impact operations. Unvetted browser extensions void institutional protections. AI cannot be a legal signatory or accountable actor.","sledRelevance":"One of the more specific campus policies on agentic AI: it turns common advice into mandatory controls and links AI purchasing on any funding source to governance review. Useful as a reference for IT and procurement offices drafting their own.","evidence":"Primary policy document. It states requirements; it does not report compliance, audits or incidents.","architectureImplications":"Agent deployments need dedicated least-privilege credentials, central audit logs of tool calls and enforced execution boundaries; internal RAG pipelines need architecture review.","governanceImplications":"The AI Governance Committee reviews purchases and internal builds; the CIO handles exceptions with risk, security and counsel; sanctions are defined.","securityPrivacyImplications":"Data-class mapping per service; agentic data guardrails to prevent caching or transmitting data beyond scope; ancillary-extension risk called out.","caveats":"Undated, so publicationDate is null. Policy intent only. The restricted-data Gemini version is not yet available.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: CWRU's policy shows what a buyer will require of any agent deployment: least-privilege identities, action logs and human checkpoints, plus governance review even for p-card purchases. Offerings must show these controls up front. Bounded help is a control-mapping review of a planned agent against such a policy. Do not claim any product complies with CWRU's policy.","engineering":"Engineering framing: design agents to this policy's controls as a baseline. Use dedicated service identities with minimal scopes, send tool-call and action logs to a central store, and enforce approval steps for irreversible actions. Expect architecture and privacy review of any RAG pipeline, and avoid relying on browser extensions. Plan for the review timelines, since every purchase and internal build goes through the committee.","delivery":"Delivery framing: add governance-committee review to project plans for any AI purchase or internal build, regardless of funding source. The committee and information security own approval; the unit owns the agent. Proposed acceptance: each deployed agent has a documented identity, permission scope, log destination and list of human checkpoints. Build committee review time into schedules and track exception requests to the CIO separately."},"roleDetails":{"sales":{"customerProblem":"Institutions need agent deployments that meet specific control requirements and pass governance review.","stakeholders":["CIO","CISO","AI Governance Committee","Procurement","Research computing"],"discoveryQuestions":["Do your agents run under dedicated least-privilege identities?","Where are agent tool calls logged?","Which actions require human approval?"],"valueHypothesis":"Interpretation: deployments designed to these controls may pass review faster; not evidenced here.","potentialEngagement":"A control-mapping review of one planned agent or RAG pipeline against the institution's AI policy.","unsupportedClaims":["That any product is policy-compliant","Enforcement effectiveness","Risk reduction figures"]},"engineering":{"fit":"Baseline controls for campus agentic AI.","architectureIntegration":"Dedicated agent identities, central logging of actions and tool calls, execution boundaries, architecture review of RAG.","prerequisites":["Identity provisioning for agents","Central log store","Data classification mapping"],"constraints":["Restricted data only on approved restricted tiers","No unvetted extensions"],"security":"Least privilege, full logging, human checkpoints, guardrails against data persistence beyond scope.","proofOfValue":["Demonstrate log capture of every tool call","Show an irreversible action blocked without approval"]},"delivery":{"work":"Put AI purchases and internal agent builds through governance and security review.","dependencies":["AI Governance Committee capacity","InfoSec review","Training"],"ownership":"AI Governance Committee and InfoSec approve; units own their agents.","skillsAdoption":"Training required for higher-tier tools.","governanceCheckpoints":["Committee review before purchase or build","CIO exception review"],"acceptanceCriteria":["Proposed: 100% of agents have documented identity, scope and logging","Proposed: no p-card AI purchases without review"],"risks":["Review backlog slows projects","Shadow tools via extensions","Policy not enforced"]}},"retrievedAt":"2026-10-19T21:56:40-05:00","enrichedAt":"2026-10-19T22:05:34-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Training requirements gate access to higher tiers; sanctions include loss of access or employment action.","procurementImplications":"P-card and grant purchases of AI tools require governance and security review, closing a common shadow-procurement route.","operatingModelImplications":"Central review of departmental AI builds and purchases; IT consultation required for exceptions.","sourceVerification":{"openedUrl":"https://case.edu/ai/sites/default/files/2026-10/Institutional%20Policy%20and%20Guidelines%20on%20Generative%20and%20Agentic%20Artificial%20Intelligence.pdf","referenceExcerpt":"Comprehensive logging and audit trails capturing agent actions, queries, tool calls, and decisions.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}