Student AI Safety: Four-Layer Guardrails, Personal Data and Teacher Monitoring

At a parent meeting a P4 class teacher is asked: "My son typed his phone number into AI for homework — where did it go?" She shows a one-page school note and the teacher monitoring panel: the input layer masks phone numbers, the output layer flags inappropriate content, and flagged messages go to human review instead of quiet deletion. A parent says, "I don't need zero risk — I need to know the school is watching." She nods: "Safety is not one switch; it is architecture that is invisible day to day and always there when needed."

Letting pupils use AI daily means answering three fears — inappropriate content, personal-data leaks and no oversight. A single filter or a policy PDF alone is not enough.

The four-layer guardrail stack

Workable pupil AI safety splits into four layers; missing any layer carries unnecessary risk:

Input guard — intercept before the message reaches the model. System prompt — inject school policy and age-band rules on every call. Output review — classify and mask after the model responds. Audit and quotas — log every interaction, cap abuse, enable traceability.

Each layer owns a segment: input blocks bad requests and personal data; prompts lock scope and Socratic rules; output handles what the model still leaks; audit tells the principal and IT who used what, when.

What the input layer stops

Before a message leaves the school system: inappropriate requests — violence, self-harm, sexual content, bullying; pupil mode should be stricter than teacher mode. Personal data — phone, ID number, address; mask before sending and remind the pupil on screen. Jailbreaks — "ignore previous rules", "pretend you are unrestricted"; refuse and log. The input layer is hard blocking, not a lecture; pupils see a short reason, teachers see full context on the panel.

Output review and audit

After the model responds: safety classification — safe, attention, block. Attention — mask sensitive parts with a notice. Block — do not show the pupil; auto-flag administrators. Audit — log user, module, model, usage, safety action on every interaction. Quotas — daily request and monthly token caps per role or user against malicious or accidental abuse. Administrators can view and export audit logs for governors or incident review.

The value of safety architecture is invisible on ordinary days and always present when needed — not a filter added after an incident.

School voice in the system prompt

Every call should inject: school language and permitted scope, age band (primary / secondary) and subject context, Socratic rules (no direct essay writing or homework completion), prohibition on requesting or outputting any personal data. Maintained centrally by administrators — not rewritten by each subject teacher — or standards drift between classes and parents cannot understand what applies. Keep version history when revising for governor briefings.

Personal-data floor

Four practices belong in contract and configuration, not verbal assurances: field encryption — phone, pupil ID, guardian contact, SEN notes encrypted at rest with AES-256. No-training terms — provider APIs under no-training clauses only. Minimal transmission — never send pupil identity to the model; learning content only. Retention — conversations and AI logs purged after configured days; retention stated in the privacy notice. At the parent meeting the teacher stresses: "The platform does not need your son's phone number, and he should not type it into the chat box."

Human review and teacher monitoring

Flagged content enters an administrator queue where a person decides: false positive — release and log. Needs follow-up — notify class teacher or counsellor. Serious — school discipline per policy. Every decision is recorded; never "quietly delete" — deletion removes the school's chance to see whether a pupil needs support.

The teacher monitoring panel should offer: live view of class pupil–AI conversations, pause AI access for an individual, flag messages for after-class follow-up, weekly misconception and risk summary. Class teachers need not read every line, but should reach full context within five minutes when someone reports or the system flags.

PDPO mapping and parent transparency

On Edor.ai, administrators configure quotas and review queues in the same console where they edit the system prompt — so policy and enforcement stay aligned when a school tightens rules after a term of pilot use. That alignment matters when a governor asks whether "we changed the settings" or "we changed the brochure".

The platform should provide mapping to the six Data Protection Principles under Hong Kong's Personal Data (Privacy) Ordinance: purpose and manner of collection, accuracy and retention, use, security, openness, access and correction. It is the document most often requested at parent meetings and by school boards.

Add a one-page parent note in plain language: what AI is used for and not used for, how data is protected, how teachers monitor, how parents can ask. Transparency is part of safety — when parents know the rules, pupils are less likely to treat AI as an anonymous chat room.

Common misreadings

• The claim: A "child-safe" filter is enough. What actually happens: Filters cover output only; personal data enters at input, jailbreaks bypass prompts, abuse needs quotas and audit — all four layers matter.

• The claim: Teacher monitoring invades pupil privacy. What actually happens: School AI is a teaching tool, not private social media; scope should be in policy — teachers see their class, administrators see by role — same logic as classroom management.

• The claim: Encryption means pupils can freely type personal data. What actually happens: Encryption protects storage, not what is sent to the model; input masking plus pupil reminders is the first line.

Three things to try on Monday

1. Audit your current AI platform against all four layers (input, prompt, output, audit and quotas); list gaps as procurement or configuration tasks.
2. Ask IT or the vendor for PDPO six-principle mapping and no-training contract clauses; file for governors.
3. Demo the monitoring panel to class teachers: how to pause an individual pupil, how to open flagged messages, and confirm a named owner for the human review queue.