{"resourceId":"hebrew-university-ai-policy-data-tiers-agent-permissions-20261028","versions":[{"version":"external-0db0e6807f650c26e05c1d798a4538098c8162973ef66a6dcd2a8e79e0b55ec0","resource":{"id":"hebrew-university-ai-policy-data-tiers-agent-permissions-20261028","title":"Hebrew University's new AI policy tiers data by vendor hosting region, limits agent permissions and requires approval before AI connects to staff email or systems","organization":"The Hebrew University of Jerusalem","sector":"Higher education administration and IT governance","geography":"Jerusalem, Israel","publishedAt":"28 October 2026 (rector's letter; policy document dated 26 October 2026)","publicationDate":"2026-10-28","eventDate":"2026-10-28","sourceName":"Office of the Rector, The Hebrew University of Jerusalem","sourceLabel":"Official institutional policy","sourceUrl":"https://en.rector.huji.ac.il/news/policy-document-use-artificial-intelligence-%E2%80%93-letter-rector-entire-university","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","developers-agents","knowledge-work"],"finding":"Hebrew University issued a university-wide AI policy covering administration as well as teaching and research. Staff may use only approved organizational licenses, which are monitored. Access to a system does not authorize moving its data into AI tools; personal data and substantive decisions need prior approval and human control. Agents get least-privilege permissions after security and privacy review, and connecting AI to email, calendars or systems requires written approval. A data table recommends European-hosted Copilot or Gemini for internal data over U.S.-hosted ChatGPT and Claude.","sledRelevance":"Offers a concrete template for administrative AI rules: data tiers mapped to approved tools, agent permission review, and consent for AI meeting notes. U.S. transfer is limited because hosting-region guidance reflects Israeli and European privacy context.","evidence":"Official policy text and rector's letter; no implementation or compliance data.","architectureImplications":"Tool choice tied to data class and server region; isolated environments for code execution by agents.","governanceImplications":"Written approval for new tools, personal data use, agent connections and AI-supported decisions.","securityPrivacyImplications":"Monitoring of organizational tools disclosed; secrets and keys barred from all AI tools; sensitive data needs dedicated environments.","caveats":"Policy only; Hebrew attachment interpreted by the agent; no evidence of enforcement or outcomes.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: Hebrew University has turned AI governance for administrative staff into concrete rules: approved licenses only, data tiers by tool and hosting region, and approval before agents touch email or systems. Interpretation: U.S. campuses writing similar rules may want a data-to-tool matrix built for FERPA and state law. A bounded engagement is a data classification and approved-tool matrix for administrative AI. Do not claim the policy reduces incidents; no data is reported.","engineering":"Engineering framing: the policy limits agents to minimum permissions after review by security, privacy and systems owners, and requires isolated environments for code execution. Interpretation: pre-sales should show how an agent's connectors, scopes and logs would pass such a review, and how tools can be restricted by data class and hosting region. The policy names principles, not technical controls, so implementation must be confirmed.","delivery":"Delivery framing: approvals now sit with a central AI tools team, the CISO and the privacy officer. Interpretation: delivery teams should build an intake workflow, a register of approved agent connections, and consent steps for AI meeting notes. Acceptance should measure approval turnaround and register completeness, since a heavy approval load could push staff toward unapproved tools."},"roleDetails":{"sales":{"customerProblem":"Administrative staff need clear rules on which AI tools may hold which data.","stakeholders":["Chief information security officer","Privacy officer","Chief information officer","Registrar","HR director"],"discoveryQuestions":["Do you map data classes to approved AI tools?","Who approves agent connections to email or ERP?","How is consent for AI meeting notes handled?"],"valueHypothesis":"Interpretation: a data-to-tool matrix could make approvals faster and consistent; the policy shows no results.","potentialEngagement":"A bounded data classification and approved-tool matrix for administrative AI.","unsupportedClaims":["Fewer incidents","Faster administrative work","Compliance with U.S. law"]},"engineering":{"fit":"Fits campuses licensing several AI vendors and planning connected agents.","architectureIntegration":"Tool selection by data class and hosting region, least-privilege agent connectors and isolated code execution.","prerequisites":["Data classification scheme","Connector permission inventory","Monitoring of organizational tools"],"constraints":["Israeli and European privacy context","Vendor hosting options vary"],"security":"Secrets never entered into AI tools; personal data requires privacy and security approval.","proofOfValue":["Demonstrate an agent connector limited to minimum scopes","Show logs proving which data class each tool received"]},"delivery":{"work":"Stand up approval workflows and registers for administrative AI use.","dependencies":["Central AI tools team","CISO and privacy officer capacity","Published approved-tool table"],"ownership":"Central AI tools team with the CISO and privacy officer.","skillsAdoption":"Staff guidance on data tiers and meeting-recording consent.","governanceCheckpoints":["Written approval for new tools","Agent permission review","Periodic policy updates"],"acceptanceCriteria":["Proposed: approval decisions within an agreed number of days","Proposed: register lists every approved agent connection"],"risks":["Approval bottlenecks","Shadow use of unapproved tools","Policy drift as vendors change"]}},"retrievedAt":"2026-10-29T21:50:43-05:00","enrichedAt":"2026-10-29T21:53:56-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Administrative staff must route doubts to supervisors and get approvals, adding workload to security and privacy officers.","procurementImplications":"Organizational licenses across four vendors with a published pricing table.","operatingModelImplications":"A central AI tools team, the CISO and privacy officer act as approval gates.","sourceVerification":{"openedUrl":"https://en.rector.huji.ac.il/news/policy-document-use-artificial-intelligence-%E2%80%93-letter-rector-entire-university","referenceExcerpt":"Updates regarding institutional AI tools, the current pricing table for organizational licenses, and usage guidelines will be available at ai.huji.ac.il","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}