Bundle Templates

ArmorEdu ships three example bundles. Each targets one agent, allowlists that agent's tools, sets per-tool block / hold overrides, and adds the domain control blocks described in Concepts. Treat them as starting points: copy a bundle, point it at your agent, and adjust the tools and thresholds to your institution.

Course & Student Records (FERPA)

Governs a course-management agent and enforces FERPA minimum-necessary handling of student data.

• Blocks export_student_records: student records may not be exported externally.
• Holds publish_final_grades: grade publication waits for human approval.
• ferpaAccessControl allows the directory, enrollment, and grades categories, requires a legitimate-interest check, and redacts student identifiers.
• studentRecordControl allows transcript, enrollment, and grade record types, blocks external export, and allowlists the registrar as an export destination.
• gradeReleaseControl requires approval and permits only final grade statuses.

Research Data & Grants

Governs a research assistant agent working with datasets and funding.

• Blocks share_dataset_external: restricted and export-controlled datasets may not be shared outside the institution.
• Holds submit_grant_proposal: proposals above the configured amount wait for approval.
• researchDataControl blocks the restricted and export-controlled classifications, allowlists an institutional-repository sharing destination, and requires de-identification.
• grantControl holds proposals above 100000 and allowlists funding agencies (for example NSF, NIH).

Office of IT

Governs an OIT operations agent with privileged capabilities.

• Blocks grant_domain_admin: the agent cannot grant domain-admin privileges.
• Holds create_privileged_account: privileged and service-account creation waits for approval.
• privilegedAccessControl blocks the domain_admin privilege, holds privileged and service account types, and allowlists the it-admin role.

Applying a bundle

Import a bundle in Policy Studio or through the platform's YAML import, set its targetId to your registered agent, review the tool list, and activate. Because import upserts by policy name, re-importing a bundle with the same name overwrites the existing one. Rename a bundle before importing if you want to keep both.