From the Campus Operations edition of October 29, 2026
Hebrew University's new AI policy tiers data by vendor hosting region, limits agent permissions and requires approval before AI connects to staff email or systems
The Hebrew University of Jerusalem · Higher education administration and IT governance · Jerusalem, Israel
- Publisher
- Office of the Rector, The Hebrew University of Jerusalem
- Original publication
- 28 October 2026 (rector's letter; policy document dated 26 October 2026)
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-28
What happened
Hebrew University issued a university-wide AI policy covering administration as well as teaching and research. Staff may use only approved organizational licenses, which are monitored. Access to a system does not authorize moving its data into AI tools; personal data and substantive decisions need prior approval and human control. Agents get least-privilege permissions after security and privacy review, and connecting AI to email, calendars or systems requires written approval. A data table recommends European-hosted Copilot or Gemini for internal data over U.S.-hosted ChatGPT and Claude.
Why it matters
Offers a concrete template for administrative AI rules: data tiers mapped to approved tools, agent permission review, and consent for AI meeting notes. U.S. transfer is limited because hosting-region guidance reflects Israeli and European privacy context.
Evidence and measured results
Official policy text and rector's letter; no implementation or compliance data.
Limitations and uncertainty
Policy only; Hebrew attachment interpreted by the agent; no evidence of enforcement or outcomes.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Administrative staff need clear rules on which AI tools may hold which data.
- Stakeholders
- Chief information security officer
- Privacy officer
- Chief information officer
- Registrar
- HR director
- Discovery questions
- Do you map data classes to approved AI tools?
- Who approves agent connections to email or ERP?
- How is consent for AI meeting notes handled?
- Value hypothesis
- Interpretation: a data-to-tool matrix could make approvals faster and consistent; the policy shows no results.
- Potential engagement
- A bounded data classification and approved-tool matrix for administrative AI.
- Unsupported claims
- Fewer incidents
- Faster administrative work
- Compliance with U.S. law
Pre-sales engineering
Role takeaway
- Fit
- Fits campuses licensing several AI vendors and planning connected agents.
- Architecture and integration
- Tool selection by data class and hosting region, least-privilege agent connectors and isolated code execution.
- Prerequisites
- Data classification scheme
- Connector permission inventory
- Monitoring of organizational tools
- Constraints
- Israeli and European privacy context
- Vendor hosting options vary
- Security
- Secrets never entered into AI tools; personal data requires privacy and security approval.
- Proof of value
- Demonstrate an agent connector limited to minimum scopes
- Show logs proving which data class each tool received
Delivery
Role takeaway
- Work
- Stand up approval workflows and registers for administrative AI use.
- Dependencies
- Central AI tools team
- CISO and privacy officer capacity
- Published approved-tool table
- Ownership
- Central AI tools team with the CISO and privacy officer.
- Skills and adoption
- Staff guidance on data tiers and meeting-recording consent.
- Governance checkpoints
- Written approval for new tools
- Agent permission review
- Periodic policy updates
- Acceptance criteria
- Proposed: approval decisions within an agreed number of days
- Proposed: register lists every approved agent connection
- Risks
- Approval bottlenecks
- Shadow use of unapproved tools
- Policy drift as vendors change
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Tool choice tied to data class and server region; isolated environments for code execution by agents.
Governance
Who approves, reviews and stays accountable for outcomes?
Written approval for new tools, personal data use, agent connections and AI-supported decisions.
Security and privacy
What data, permissions and controls need testing?
Monitoring of organizational tools disclosed; secrets and keys barred from all AI tools; sensitive data needs dedicated environments.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Administrative staff must route doubts to supervisors and get approvals, adding workload to security and privacy officers.
Procurement
What should contracts, pricing and exit terms secure?
Organizational licenses across four vendors with a published pricing table.
Operating model
Which teams own the service once it runs?
A central AI tools team, the CISO and privacy officer act as approval gates.
Publication history
- 2026-10-29Campus Operations · Issue 525 resources
Stable resource ID: hebrew-university-ai-policy-data-tiers-agent-permissions-20261028