4
allowed verbs
Otto AI is framed around draft, explain, prioritize, and alert. It does not decide.
AI transparency
AI drafts, explains, prioritizes, and alerts. People decide.
Otto's AI is designed as a governed layer inside the school record: visible, permission-scoped, source-aware where retrieval exists, and blocked from consequential decisions without human approval.
0
AI-only decisions
Grades, refunds, status changes, aid-affecting determinations, dismissals, admissions decisions, and compliance submissions need authorized people.
No
model training without consent
School data is not used to train or fine-tune Otto or vendor models without written school consent.
Per school
AI controls
Global AI, feature-level controls, Otto Deep confirmation, and kill switches are school-controlled requirements.
Design stance
The four verbs stay bounded.
The public AI story stays simple: Otto helps people work faster and see risk sooner, but it does not replace judgment.
Draft, explain, prioritize, alert
AI can help prepare work and surface risk, but it does not make consequential school decisions.
Visible and permission-scoped
AI surfaces stay visibly labeled and are planned to respect the same role and tenant boundaries as the product.
Sources where applicable
Regulatory, policy, and student-record assistance should point back to source material when retrieval exists.
Human approval
Consequential actions such as notices, grades, refunds, compliance submissions, and record changes require human review.
Operating model
Core first. Deep only when needed.
Otto starts with the smallest safe route and escalates only when the task requires deeper reasoning.
Otto Core first
Preview verifiedDefault route
Every request starts with the smallest safe route: deterministic engines, search, rules, prioritization, and fast private processing before deeper generation is considered.
Review AI foundationOtto Deep only when needed
PlannedEscalation path
Deeper reasoning is for generation, tutoring, grading drafts, complex analysis, or failed validation. Schools can require confirmation before staff escalation.
Review provider gatesRestricted data stays blocked
Preview verifiedHard boundary
SSNs, government IDs, bank/card numbers, and disability documentation must not be sent to AI models. Deep routing receives only minimum pseudonymized context.
Review minimizationPrivate AI mode
PlannedLater activation
Private AI mode is a school-controlled route for approved processing boundaries. It is not active until provider governance and contracts are complete.
Review Private AI blockersControls
The safeguards a school should be able to inspect.
Buyer-facing AI claims are tied to specific controls so the page does not drift into generic AI marketing.
Visible AI treatment
Students and staff should know when Otto generated or suggested something.
AI surfaces use Otto AI treatment, source/approval context where applicable, and should record model and prompt metadata when live.
Review AI settingsPermission-scoped tools
AI can only see and do what the requesting user is allowed to see and do.
Read tools run under the user's tenant, role, and scope. Model output cannot choose tenant, user, student, payment, grade, or record identifiers.
Review AI toolsGrounded sources
Answers about policy, coursework, records, and compliance need inspectable source material.
Retrieval, citations, and source labels are product requirements. Production retrieval and citations are not live on the public site.
Review retrieval gatesValidated outputs
AI text is untrusted until it passes schemas and product rules.
Local validation contracts reject model-supplied identifiers and fail closed. No live assistant route stores or shows production AI output as actionable yet.
Review guardrailsUsage ledger and evals
Schools need cost, latency, prompt version, outcome, and quality evidence before AI scales.
Usage ledger, budgets, rate limits, prompt versions, and evaluation suites are requirements; production operations remain gated.
Review usage gatesSchool kill switches
A school should be able to turn AI off globally or by feature.
Global AI, student AI, staff AI, Private AI, Otto Deep, and feature switches are school-control requirements before production rollout.
Review switch controlsHuman approval before consequences
AI
Human approval before consequences
Public AI policy
AI can draft, explain, prioritize, and alert. It cannot complete a grade release, refund, status change, aid-affecting decision, dismissal, admissions decision, or compliance submission on its own.
Grades
AI may draft rubric suggestions and feedback, but instructors approve released grades.
Status and standing
Enrollment, SAP, dismissal, leave, withdrawal, and credential status changes require authorized staff action.
Money and aid
Refunds, payment retries, aid-affecting determinations, and ledger-impacting actions require human approval.
Admissions and compliance
Admissions decisions, official notices, compliance submissions, and corrective actions stay human-owned.
Data and model boundaries
No model training without consent
School data is not used to train or fine-tune Otto or vendor models without written consent.
Restricted data block
SSNs, government IDs, bank/card numbers, and disability documentation must not be sent to models.
No AI detector evidence
Otto does not ship AI-writing-detector scores as evidence of misconduct.
Minimum context
Deep reasoning receives only the minimum pseudonymized context the task needs, after permission and data-minimization checks.
Public boundary
- Otto does not ship AI-writing detector scores as evidence of misconduct.
- Restricted data such as SSNs, government IDs, bank/card numbers, and disability documentation is not sent to AI models.
- Schools need AI visibility, school-level kill switches, and permission-scoped controls.
- Private AI mode and zero-data-retention provider contracting are later milestones.
- No real AI calls, retrieval, citations, usage ledger, or model routing are implemented in this ticket.