From the Campus Operations edition of October 16, 2026
Washington State University gates Claude behind training, a signed AI stewardship agreement and Okta SSO, approving it for Public and Internal data only
Washington State University, Information Technology Services · Public research university central IT · Washington, United States
- Publisher
- Washington State University Information Technology Services
- Original publication
- 16 October 2026 (WSU ITS news post)
- Source retrieved
- 2026-10-17
What happened
WSU ITS published knowledge-base articles and a new Information Stewardship Agreement (ISA) and AI Services Access Request form governing department-purchased premium AI services. Claude Team is the only Claude account type approved for university use and is approved for WSU Public and Internal data only under policy UPPM 87.53. Access requires completing 'Responsible Use of AI' training in Percipio, signing the ISA and submitting a request that becomes a Crimson Service Desk ticket. Teams hold up to 150 users with a two-seat minimum, at least two owners are requested, and owners bill through their unit's fiscal office. On 12 May 2027 WSU will enforce Okta SSO, affecting about 760 users who currently use Claude with a WSU email outside the WSU Team process; accounts on shared or departmental mailboxes are not compatible. The ISA requires minimum-necessary data use, treating AI content as WSU records, approved tools and managed accounts only, prior agreements before entering FERPA, HIPAA or CJIS records, review before sharing, and incident reporting. Why now: this follows WSU's auto-activated Gemini rollout (archived 30 September item) and shows a second, department-funded, gated tier for premium tools.
Why it matters
A concrete public-university pattern for bringing shadow AI accounts under central identity, records and data-classification control while letting departments pay for premium seats.
Evidence and measured results
Operator-published process and policy description. The 760-user figure is WSU's own count of unmanaged accounts using WSU addresses; no usage, cost or outcome data is reported.
Limitations and uncertainty
Announcement only; the knowledge-base articles were not separately opened. No evidence on adoption, compliance with the ISA, or whether the May 2027 enforcement date holds. Data-class approvals are specific to WSU policy.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-16; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Staff are already using premium AI on personal accounts tied to university email, outside identity, records and data-class controls.
- Stakeholders
- CIO and IAM lead
- Chief information security officer
- Records manager
- Department fiscal officers
- Data stewards for FERPA and HIPAA data
- Discovery questions
- How many AI accounts use institutional email without SSO today?
- Which data classes may each AI service handle under current policy?
- Who pays for premium seats, and who approves membership?
- How are shared or departmental mailboxes used for AI today?
- Value hypothesis
- Interpretation: a gated access path can shrink unmanaged AI use and clarify data-class limits, measured by accounts migrated before an SSO cutoff.
- Potential engagement
- A six-week account inventory, stewardship-agreement and SSO-migration plan for one AI service.
- Unsupported claims
- Any productivity or cost savings
- That the ISA changes user behavior
- That 760 accounts will migrate rather than export or lapse
Pre-sales engineering
Role takeaway
- Fit
- Fits institutions with an enterprise IdP and a vendor that supports SSO, team tenancy and admin export.
- Architecture and integration
- IdP (Okta or equivalent) SSO enforcement, service-desk ticket-driven provisioning, vendor team admin roles, and training-system completion checks.
- Prerequisites
- Enterprise IdP with SSO for the AI vendor
- Data classification policy naming approved AI uses
- Training platform with completion records
- Service-desk workflow for access requests
- Constraints
- Shared or departmental mailboxes cannot use SSO
- Data-class approval limited to Public and Internal for this service
- Seat limits of 150 per Team and two-seat minimum
- Security
- Enforce SSO and remove email-only sign-in; restrict regulated data until agreements exist; require incident reporting channels.
- Proof of value
- Count unmanaged accounts before and after enforcement
- Confirm export works for departing users
- Verify audit logs show membership changes approved by IT
Delivery
Role takeaway
- Work
- Inventory accounts, run training and ISA intake, provision Teams through tickets, migrate or export unmanaged accounts before the SSO date.
- Dependencies
- Vendor domain-capture and SSO features
- Department budget for seats
- Training content and completion tracking
- Ownership
- Central IT owns identity and approval; department Team owners own membership and billing.
- Skills and adoption
- Team owners need admin training on membership, connectors and usage credits; users need the responsible-use course.
- Governance checkpoints
- Data-class approval for each AI service
- ISA signed before invitation
- Records-retention treatment for AI content confirmed
- Acceptance criteria
- Proposed: 90% of identified unmanaged accounts migrated or exported before cutoff
- Proposed: every Team has two named owners
- Proposed: zero shared-mailbox AI accounts after cutoff
- Risks
- Users lose work if they miss the export window
- Departments without budget stay on unapproved tools
- Training gate slows legitimate access
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Identity becomes the control point: Okta SSO enforcement, Team membership confirmed by ITS, and service-desk ticketing for provisioning. Shared mailboxes cannot be used as AI identities, so departmental workflows built on shared accounts need migration or export before May 2027.
Governance
Who approves, reviews and stays accountable for outcomes?
Combines mandatory training, a signed per-user stewardship agreement, data-class restrictions (Public and Internal only for Claude Team) and records-management obligations; premium tools are department-funded, so governance is central while spend is distributed.
Security and privacy
What data, permissions and controls need testing?
Restricting Claude Team to Public and Internal data and requiring agreements before FERPA, HIPAA or CJIS records reduces regulated-data exposure; the 760 unmanaged accounts indicate an existing shadow-AI footprint that remains until enforcement.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Training is a precondition for access; staff on personal or shared accounts must move work or export data, which may burden small units without IT support.
Procurement
What should contracts, pricing and exit terms secure?
Department purchase of seats through fiscal offices, with ITS confirming membership, separates budget authority from approval authority.
Operating model
Which teams own the service once it runs?
ITS acts as gatekeeper and registrar rather than central buyer; each Team needs two owners, creating a distributed administrator role across departments.
Publication history
- 2026-10-16Campus Operations · Issue 396 resources
Stable resource ID: wsu-its-claude-team-access-information-stewardship-agreement-20261016