{"resourceId":"wsu-its-claude-team-access-information-stewardship-agreement-20261016","versions":[{"version":"external-4081cfa4497890ad1dd93b42d42d4cd825dd8c22a84995fbb7e983d3e983ddcc","resource":{"id":"wsu-its-claude-team-access-information-stewardship-agreement-20261016","title":"Washington State University gates Claude behind training, a signed AI stewardship agreement and Okta SSO, approving it for Public and Internal data only","organization":"Washington State University, Information Technology Services","sector":"Public research university central IT","geography":"Washington, United States","publishedAt":"16 October 2026 (WSU ITS news post)","publicationDate":"2026-10-16","eventDate":null,"sourceName":"Washington State University Information Technology Services","sourceLabel":"Institutional IT guidance and access-control announcement (operator-published)","sourceUrl":"https://its.wsu.edu/2026/10/16/claude-access-guidance-and-ai-information-stewardship-agreement/","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"WSU ITS published knowledge-base articles and a new Information Stewardship Agreement (ISA) and AI Services Access Request form governing department-purchased premium AI services. Claude Team is the only Claude account type approved for university use and is approved for WSU Public and Internal data only under policy UPPM 87.53. Access requires completing 'Responsible Use of AI' training in Percipio, signing the ISA and submitting a request that becomes a Crimson Service Desk ticket. Teams hold up to 150 users with a two-seat minimum, at least two owners are requested, and owners bill through their unit's fiscal office. On 12 May 2027 WSU will enforce Okta SSO, affecting about 760 users who currently use Claude with a WSU email outside the WSU Team process; accounts on shared or departmental mailboxes are not compatible. The ISA requires minimum-necessary data use, treating AI content as WSU records, approved tools and managed accounts only, prior agreements before entering FERPA, HIPAA or CJIS records, review before sharing, and incident reporting. Why now: this follows WSU's auto-activated Gemini rollout (archived 30 September item) and shows a second, department-funded, gated tier for premium tools.","sledRelevance":"A concrete public-university pattern for bringing shadow AI accounts under central identity, records and data-classification control while letting departments pay for premium seats.","evidence":"Operator-published process and policy description. The 760-user figure is WSU's own count of unmanaged accounts using WSU addresses; no usage, cost or outcome data is reported.","architectureImplications":"Identity becomes the control point: Okta SSO enforcement, Team membership confirmed by ITS, and service-desk ticketing for provisioning. Shared mailboxes cannot be used as AI identities, so departmental workflows built on shared accounts need migration or export before May 2027.","governanceImplications":"Combines mandatory training, a signed per-user stewardship agreement, data-class restrictions (Public and Internal only for Claude Team) and records-management obligations; premium tools are department-funded, so governance is central while spend is distributed.","securityPrivacyImplications":"Restricting Claude Team to Public and Internal data and requiring agreements before FERPA, HIPAA or CJIS records reduces regulated-data exposure; the 760 unmanaged accounts indicate an existing shadow-AI footprint that remains until enforcement.","caveats":"Announcement only; the knowledge-base articles were not separately opened. No evidence on adoption, compliance with the ISA, or whether the May 2027 enforcement date holds. Data-class approvals are specific to WSU policy.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: WSU shows the shadow-AI cleanup problem in numbers, with about 760 unmanaged accounts tied to university email. Institutions in the same position need help inventorying accounts, setting data-class rules and migrating users before an SSO cutoff. A bounded offer is an account-consolidation and stewardship-agreement readiness review. Do not claim cost savings or productivity gains; WSU reports none, and the evidence only supports a governance and risk-reduction case.","engineering":"Engineering framing: the design pattern is SSO enforcement plus Team-based tenancy, ticketed provisioning and data-class limits. Pre-sales should check IdP integration, the vendor's admin APIs for membership and export, and how shared or departmental mailboxes will be handled, since WSU says they are incompatible with SSO. Validate whether audit logs and connector controls satisfy records obligations, and test the export path for users who will not join a Team.","delivery":"Delivery framing: the work is a migration with a hard date. Delivery teams would inventory existing accounts, move users into owned Teams, verify training and ISA completion before invitation, and run export support for those leaving. Ownership sits with central IT for identity and with department Team owners for membership and billing. Acceptance should track migrated accounts, unresolved shared-mailbox cases and ISA completion before enforcement."},"roleDetails":{"sales":{"customerProblem":"Staff are already using premium AI on personal accounts tied to university email, outside identity, records and data-class controls.","stakeholders":["CIO and IAM lead","Chief information security officer","Records manager","Department fiscal officers","Data stewards for FERPA and HIPAA data"],"discoveryQuestions":["How many AI accounts use institutional email without SSO today?","Which data classes may each AI service handle under current policy?","Who pays for premium seats, and who approves membership?","How are shared or departmental mailboxes used for AI today?"],"valueHypothesis":"Interpretation: a gated access path can shrink unmanaged AI use and clarify data-class limits, measured by accounts migrated before an SSO cutoff.","potentialEngagement":"A six-week account inventory, stewardship-agreement and SSO-migration plan for one AI service.","unsupportedClaims":["Any productivity or cost savings","That the ISA changes user behavior","That 760 accounts will migrate rather than export or lapse"]},"engineering":{"fit":"Fits institutions with an enterprise IdP and a vendor that supports SSO, team tenancy and admin export.","architectureIntegration":"IdP (Okta or equivalent) SSO enforcement, service-desk ticket-driven provisioning, vendor team admin roles, and training-system completion checks.","prerequisites":["Enterprise IdP with SSO for the AI vendor","Data classification policy naming approved AI uses","Training platform with completion records","Service-desk workflow for access requests"],"constraints":["Shared or departmental mailboxes cannot use SSO","Data-class approval limited to Public and Internal for this service","Seat limits of 150 per Team and two-seat minimum"],"security":"Enforce SSO and remove email-only sign-in; restrict regulated data until agreements exist; require incident reporting channels.","proofOfValue":["Count unmanaged accounts before and after enforcement","Confirm export works for departing users","Verify audit logs show membership changes approved by IT"]},"delivery":{"work":"Inventory accounts, run training and ISA intake, provision Teams through tickets, migrate or export unmanaged accounts before the SSO date.","dependencies":["Vendor domain-capture and SSO features","Department budget for seats","Training content and completion tracking"],"ownership":"Central IT owns identity and approval; department Team owners own membership and billing.","skillsAdoption":"Team owners need admin training on membership, connectors and usage credits; users need the responsible-use course.","governanceCheckpoints":["Data-class approval for each AI service","ISA signed before invitation","Records-retention treatment for AI content confirmed"],"acceptanceCriteria":["Proposed: 90% of identified unmanaged accounts migrated or exported before cutoff","Proposed: every Team has two named owners","Proposed: zero shared-mailbox AI accounts after cutoff"],"risks":["Users lose work if they miss the export window","Departments without budget stay on unapproved tools","Training gate slows legitimate access"]}},"retrievedAt":"2026-10-16T21:55:05-05:00","enrichedAt":"2026-10-16T22:00:58-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Training is a precondition for access; staff on personal or shared accounts must move work or export data, which may burden small units without IT support.","procurementImplications":"Department purchase of seats through fiscal offices, with ITS confirming membership, separates budget authority from approval authority.","operatingModelImplications":"ITS acts as gatekeeper and registrar rather than central buyer; each Team needs two owners, creating a distributed administrator role across departments.","sourceVerification":{"openedUrl":"https://its.wsu.edu/2026/10/16/claude-access-guidance-and-ai-information-stewardship-agreement/","referenceExcerpt":"Claude Team is approved for WSU Public and Internal data only under UPPM 87.53.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}