# TEACH Agent Team and Deterministic Routing

## Binding implementation contract

**Canonical program:** `NAIO-NEID-COMPLETE-TEACH-1.0`  
**Foundation / overlay:** `NAIO-NE-LPEF-1.0` / `NAIO-NEID-TEACH-1.0`  
**Namespace:** `neid_teach.*`  
**Product ID:** `nurse-educator-instructional-designer-mission-control`  
**Route:** `/nurse-educators-designers/dashboard`  
**Installed agent state:** `PERM-P0 Disabled`

Agent IDs, permissions, charters, state machines, and routing are build-layer additions. The legacy TEACH corpus defines powers and workflows, not formal agents. An installed definition gives no model access, network, tools, memory, schedule, connector, destination, background execution, or authority.

TEACH remains fully useful without AI. If a genuine configured backend is absent or unhealthy, show `AI unavailable`, keep every agent P0, and preserve manual/offline missions, planning, templates, synthetic design, source metadata, capability evidence, and recovery. Never substitute canned output, fake streaming, invented citations, simulated tools, or delayed sample text.

## 1. Frozen inventory and routing invariants

Preserve:

- exactly three adapters: Nurse Educator; Instructional Designer; Hybrid or Faculty Developer;
- exactly five protected workspaces;
- two deployment contexts;
- one authenticated owner and one active adapter, task hat, workspace, deployment context, institution-or-Personal context, purpose, authority ceiling, and data ceiling per mission;
- Core Four: Plan My Day; Design & Align; Assess & Support; Review & Release;
- 20 powers `Available Inactive`, 18 workflows `Preview Only`, 24 templates, and an empty fifth launcher;
- 33 foundation, 120 overlay, and 16 integration checks: 169 canonical checks;
- ten inert agent definitions;
- independent `edena_tier` and `absolute_stop`; and
- no learner-record payload, PHI, live care, secure assessment content, or external execution.

An agent recommendation, power preview, workflow selection, dashboard launcher, badge, title, profile, prior run, or technical availability never activates an agent.

The exact five workspace names are **Life, Capacity & Career**; **Teaching, Learning Design & Accessibility**; **Assessment, Feedback & Learner Support**; **Clinical, Skills-Lab & Simulation**; and **Curriculum, Program Evaluation, Scholarship & Faculty Development**.

## 2. Exact agent registry

| ID | Exact build-layer name | Bounded purpose | Installed | Maximum after separate one-run authorization |
|---|---|---|---|---|
| `TEACH-AGT-01` | Educator Life, Capacity & Career Planning Coach | Turn owner-selected schedules, capacity categories, commitments, protected time, career, scholarship, leadership, and whole-life goals into Minimum, Standard, Stretch, or Re-entry options. | `PERM-P0 Disabled` | P1 on selected `TEACH-DATA-2`; no diagnosis, fitness/wellbeing finding, financial/legal/employment advice, institutional analytics, or private-detail badge evidence. |
| `TEACH-AGT-02` | Learning Design & Alignment Architect | Draft outcome-aligned learning experiences, course journeys, modality options, active learning, formative checks, and source-aware design briefs. | `PERM-P0 Disabled` | P2 on exact allowlisted `TEACH-DATA-0/C` or synthetic data; no learner data, clinical truth claim, curriculum approval, release, or LMS action. |
| `TEACH-AGT-03` | Accessibility, Inclusion & Cognitive-Load Reviewer | Review draft materials for semantic structure, access routes, representation, modality equivalence, participation burden, cognitive load, and missing perspectives. | `PERM-P0 Disabled` | P2 on permitted drafts/sources; no disability inference, accommodation decision, accessibility/compliance certification, learner scoring, or release. |
| `TEACH-AGT-04` | Assessment, Rubric & Feedback Design Coach | Design synthetic blueprints, generic rubrics, calibration fixtures, feedback structures, AI-use rules, and human grading/review checklists. | `PERM-P0 Disabled` | P2 on synthetic/generic artifacts and exact non-person course content only; no learner submission, grade/evaluation, secure item, validity/reliability/fairness determination, feedback release, or misconduct finding. |
| `TEACH-AGT-05` | Learner Communication & Human-Support Rehearsal Coach | Prepare generic, private, human-owned office-hour, announcement, supportive-conversation, referral-question, and follow-through rehearsals. | `PERM-P0 Disabled` | P1 on synthetic or owner-authored nonsensitive inputs; no learner record, profiling/inference, contact, referral action, promise, conduct decision, or impersonation. |
| `TEACH-AGT-06` | Clinical, Skills-Lab & Simulation Safety and Source Scout | Retrieve approved public/generic sources and prepare synthetic objectives, cases, prebriefs, roles, equipment questions, stop rules, observation tools, accessibility, and human-led debrief plans. | `PERM-P0 Disabled` | P2 on synthetic/public/approved generic content; no patient data/live care, clinical direction, competence/readiness declaration, learner evaluation, scenario release, or equipment control. |
| `TEACH-AGT-07` | Curriculum, Competency & Accreditation Evidence Mapper | Map exact approved outcomes, competency sources, course/curriculum evidence, gaps, owners, versions, and exact approved aggregate program evidence. | `PERM-P0 Disabled` | P2 on `TEACH-DATA-0/C/A`; no learner rows, compliance/accreditation determination, research classification, causality, improvement certification, submission, or policy change. |
| `TEACH-AGT-08` | Sources, Rights, OER & Scholarship Integrity Librarian | Maintain sources, claim links, versions, applicability, conflicts, corrections, rights/licenses, attribution, expiry, literature matrices, disclosure, and authorship questions. | `PERM-P0 Disabled` | P2 read-only on allowlisted sources/permitted metadata; no invented citation, paywall bypass, restricted-work laundering, fair-use/legal sufficiency, authorship, ethics/research determination, submission, or publication. |
| `TEACH-AGT-09` | AI Literacy & Governed Learning-Technology Workflow Designer | Design synthetic AI-literacy labs and manual-first learning-technology workflows with triggers, owners, checks, failure, fallback, rollback, expiry, and stop rules. | `PERM-P0 Disabled` | P2 on synthetic/public/approved generic sources; no learner monitoring, connector, LMS/gradebook action, pilot execution, background automation, external destination, or institutional release. |
| `TEACH-AGT-10` | Independent Agent Auditor & Kill Sentinel | Test one frozen agent/configuration against privacy, authority, source, rights, accessibility, injection, cancellation, recovery, receipt, and context fixtures. | `PERM-P0 Disabled` | P1 on a separate control path; cannot audit itself, approve release, alter the tested agent or evidence, or become the sole human reviewer. |

Maximum permission is a ceiling, not a grant. A run may be authorized below its maximum. No agent may activate, modify, delegate to, approve, score as sole judge, widen, retire, or reactivate itself.

## 3. Permission and automation model

Store installed, requested, approved, maximum, and effective permission separately.

| Level | Meaning | Enforcement |
|---|---|---|
| `PERM-P0` | Disabled; installed default for every agent, connector, destination, and action | No inference, retrieval, model call, tool, network, memory, schedule, destination, or background work. |
| `PERM-P1` | One owner-approved local/session run on exact `TEACH-DATA-1` or selected screened `TEACH-DATA-2` | Draft/rehearsal only; no external retrieval, institution/course data, learner data, contact, send, release, connector, schedule, or consequential execution. |
| `PERM-P2` | One owner- and, where required, institution-approved read-only run on an exact source allowlist or exact `TEACH-DATA-C/A` object | Hash-bound and expiring; no learner/person row, external write, official-system action, teaching use, grade/feedback release, pilot, policy/curriculum change, submission, or publication. |
| `PERM-P3` | Separately approved deterministic local personal reminder after three supervised successful runs | Not a model/agent permission. Local, owner-visible, editable, stoppable, nonsensitive; no model, institution/course/learner data, connector, external destination, monitoring, education decision, or release. |
| `PERM-P4` | External, official-system, learner-facing, clinical, grading, publishing, institutional-change, monitoring, or other consequential authority | **Absent.** No prompt, title, badge, plug-in, profile, policy receipt, or configuration can enable it. |

Effective permission is the most restrictive result across agent maximum, human grant, role adapter/hat, workspace, deployment context, institution/course/project bind, purpose, data class, source/rights status, `edena_tier`, `absolute_stop`, TEACH Gate, backend health, tools, expiry, and deny rules.

The source's “three supervised runs” permits only review of P3 deterministic local reminder eligibility. It never creates model autonomy, background work, LMS connectivity, monitoring, release, or institutional permission.

## 4. One-run state machine and charter

Use the closed state machine:

`disabled → draft_charter → one_run_proposed → one_run_authorized → running → reconciled → disabled`

Also support `blocked`, `cancelled`, `killed`, `expired`, and `retired`. A denied, failed, interrupted, mismatched, cancelled, killed, or expired run cannot remain running. Invalid transitions fail closed and create only a content-free receipt.

Every P1/P2 charter binds:

- exact agent, model, system prompt, policy, input/output schema, and tool versions/hashes;
- one owner-authored objective and non-goals;
- one adapter, task hat, workspace, deployment context, institution-or-Personal context, and purpose;
- exact `TEACH-DATA-*` class and permitted object/source hashes;
- institution/program/course/project and human authority receipts when applicable;
- `edena_tier`, independent `absolute_stop`, complete TEACH Gate, source/rights status, retention, and expiry;
- one invocation, zero hidden retries, no recursion, exact read-only tools, empty external destinations, and time/cost/token limits;
- accessibility, inclusion, learner-data, PHI/live-care, secure-assessment, no-surveillance, prompt-injection, disclosure, and independence tests;
- visible Stop/Kill, timeout, human checkpoints, manual fallback, reconciliation, temporary-state purge, and retirement route; and
- plain-language preview of what the agent will and will not do.

Any material role, hat, workspace, context, purpose, data, source, rights, audience, destination, model, prompt, policy, schema, tool, permission, or version change invalidates authorization and returns the run to `draft_charter` or `blocked`.

## 5. Deterministic routing pipeline

Routing is ordinary application code; a model may not choose its own authority.

1. Read authenticated owner, adapter, task hat, workspace, deployment context, institution/course/project, purpose, desired artifact, selected launcher/power/workflow, data class, authority receipts, `edena_tier`, `absolute_stop`, and TEACH result.
2. Reject `TEACH-DATA-X` before storage, logs, search, indexing, embeddings, memory, prompt assembly, or analytics. Do not echo the body.
3. Reject every learner/assessment/person payload. `TEACH-DATA-R` is opaque reconciliation metadata only.
4. In Private Mode, reject `TEACH-DATA-M/C/A/R` unless the narrow record is expressly permitted for a local noninstitutional purpose; institutional content/aggregate processing requires a current institutional bind.
5. Resolve the exact selected power/workflow. Ambiguous free text opens a chooser or one minimum-necessary clarification; a model cannot infer a consequential lane.
6. Apply the frozen routing tables below.
7. Apply role/hat ceiling, workspace/context, source/rights/data, EDENA/absolute-stop/TEACH, permission, backend, expiry, and auditor-separation rules.
8. Show a Routing Card: selected power/workflow, suggested agent, match reason, rejected alternatives, installed/requested/maximum/effective permission, role/hat/workspace/context, data/source/rights, authority, EDENA/absolute stop/TEACH, limits, human reviewer, external-action status, Stop/Kill, fallback, and expiry.
9. Allow owner override only among compatible routes. An override cannot widen data, authority, permission, tools, action, or context.
10. Require a fresh expiring one-run approval, execute once with genuine events, reconcile, purge temporary state, revoke permission, and return to disabled.

If no route is eligible, use `human_or_manual` and keep the local workflow available without AI.

## 6. Exact power routing

`TEACH-PWR-01`–`20` are build-layer keys; displayed titles remain exact source titles.

| Key | Exact power title | Suggested route and narrowing |
|---|---|---|
| `TEACH-PWR-01` | Teaching Identity & Learner Promise Compass | `TEACH-AGT-01` or `02`; owner-authored identity/mission only, no false personalization or institution voice. |
| `TEACH-PWR-02` | Backward Design & Alignment Architect | `TEACH-AGT-02`; exact approved outcomes/sources, no curriculum approval. |
| `TEACH-PWR-03` | Evidence-Informed Learning Experience Studio | `TEACH-AGT-02` and optional `08`; draft only, source and rights review required. |
| `TEACH-PWR-04` | Course Journey, Modality & Cognitive-Load Mapper | `TEACH-AGT-02` and `03`; generic learner variability, no individual profiling. |
| `TEACH-PWR-05` | Universal Design & Accessibility Co-Designer | `TEACH-AGT-03`; draft audit only, no accommodation/compliance certification. |
| `TEACH-PWR-06` | Inclusive Pedagogy, Belonging & Bias Lens | `TEACH-AGT-03`; no trait inference, ranking, or learner labels. |
| `TEACH-PWR-07` | Active Learning & Engagement Lab | `TEACH-AGT-02`; synthetic/generic activities, human teaching and debrief. |
| `TEACH-PWR-08` | Learner Voice, Support & Communication Navigator | `TEACH-AGT-05`; generic rehearsal only, no learner record, contact, or decision. |
| `TEACH-PWR-09` | Authentic Assessment & Blueprint Architect | `TEACH-AGT-04`; synthetic/generic design, no secure items, learner data, or grade. |
| `TEACH-PWR-10` | Rubric, Feedback & Calibration Studio | `TEACH-AGT-04`; synthetic calibration and generic feedback patterns only. |
| `TEACH-PWR-11` | Academic Integrity & AI-Use Contract Builder | `TEACH-AGT-04` and `09`; activity-level draft, no misconduct finding or detector-as-proof. |
| `TEACH-PWR-12` | Learning Evidence & Program-Evaluation Sensemaker | `TEACH-AGT-07`; exact `TEACH-DATA-A` only in bound institutional context; no causal/success claim. |
| `TEACH-PWR-13` | Clinical, Skills-Lab & Simulation Safety Studio | `TEACH-AGT-06`; synthetic only, no patient/live care, competence decision, or learner release. |
| `TEACH-PWR-14` | Curriculum, Competency & Accreditation Mapper | `TEACH-AGT-07`; exact sources and evidence gaps, no compliance/accreditation determination. |
| `TEACH-PWR-15` | Content, Media, Copyright & OER Steward | `TEACH-AGT-08`; rights facts/questions only, no fair-use/legal determination. |
| `TEACH-PWR-16` | Source, Version & Knowledge Integrity Librarian | `TEACH-AGT-08`; read-only allowlist, conflicts and expiry visible. |
| `TEACH-PWR-17` | AI Literacy & Responsible-Use Academy | `TEACH-AGT-09`, with `10` eligible to audit a frozen synthetic lab; no credential claim. |
| `TEACH-PWR-18` | Governed Learning-Technology & Automation Lab | `TEACH-AGT-09`; manual/synthetic design only; no connector, pilot execution, or LMS write. |
| `TEACH-PWR-19` | Faculty/Designer Workload & Capacity Shield | `TEACH-AGT-01`; private structural planning only, no diagnosis, surveillance, or institution analytics. |
| `TEACH-PWR-20` | Scholarship, Portfolio, Career & Leadership Catalyst | `TEACH-AGT-01` and `08`; truthful contribution/source records, no credential/promotion/publication guarantee or submission. |

## 7. Exact workflow routing

All workflows install `Preview Only`.

| Key | Exact workflow title | Primary route |
|---|---|---|
| `TEACH-WF-01` | Daily Educator/Designer Brief | Manual or `TEACH-AGT-01`. |
| `TEACH-WF-02` | Weekly TEACH Reset | Manual or `TEACH-AGT-01`. |
| `TEACH-WF-03` | Outcome-to-learning-experience design | `TEACH-AGT-02`. |
| `TEACH-WF-04` | Course or module build and revision sprint | `TEACH-AGT-02`, optional `03/08`; draft only. |
| `TEACH-WF-05` | Session or lesson launch pack | `TEACH-AGT-02/03`; “launch” means preparation, not release. |
| `TEACH-WF-06` | Accessibility and inclusive-design release gate | `TEACH-AGT-03`; human verification required. |
| `TEACH-WF-07` | Authentic assessment and blueprint design | `TEACH-AGT-04`; synthetic/generic only. |
| `TEACH-WF-08` | Evidence-first feedback with human grading | `TEACH-AGT-04`; title preserved, but base accepts no learner evidence; generic/synthetic feedback structure only. |
| `TEACH-WF-09` | Academic-integrity and AI-use plan | `TEACH-AGT-04/09`; policy draft, no person finding. |
| `TEACH-WF-10` | Clinical or simulation design, verification, prebrief, and release | `TEACH-AGT-06`; synthetic preparation only; release is external human action. |
| `TEACH-WF-11` | Learner-support conversation and referral preparation | `TEACH-AGT-05`; generic rehearsal, no learner data/contact/referral action. |
| `TEACH-WF-12` | Curriculum, competency, and accreditation evidence mapping | `TEACH-AGT-07`; no determination/submission. |
| `TEACH-WF-13` | Approved aggregate learning-evidence sensemaking | `TEACH-AGT-07`; exact `TEACH-DATA-A`, bound institutional context only. |
| `TEACH-WF-14` | Copyright, OER, and media clearance | `TEACH-AGT-08`; fact/rights checklist, no legal clearance declaration. |
| `TEACH-WF-15` | Faculty-development or learner AI-literacy workshop | `TEACH-AGT-09`, optional `02/03`; design only, external delivery. |
| `TEACH-WF-16` | Governed learning-technology or automation pilot | `TEACH-AGT-09` and optional independent `10`; synthetic/manual preview only; real pilot external. |
| `TEACH-WF-17` | Scholarship, promotion, and portfolio sprint | `TEACH-AGT-01/08`; truthful private draft, no submission or outcome guarantee. |
| `TEACH-WF-18` | Overload Rescue and Minimum/Re-entry Mode | Human-first, optional `TEACH-AGT-01`; protect capacity and route urgent needs, no diagnosis. |

## 8. Core Four routing

- **Plan My Day:** manual local form or `TEACH-AGT-01`; no institution readiness, faculty-performance, or learner signal.
- **Design & Align:** explicit choice among `TEACH-AGT-02/03/06/07/08`; exact source/data/rights and human release owner required.
- **Assess & Support:** `TEACH-AGT-04/05` for synthetic/generic design only; no learner payload, grade, evaluation, finding, or contact.
- **Review & Release:** deterministic TEACH Gate and human-review queue. No agent approves or releases. All execution is external.

Pinning a fifth power does not activate an agent or widen authority.

## 9. Adapter and workspace ceilings

### Nurse Educator

May prepare within verified assigned authority. The app cannot infer authority from licensure, faculty title, course access, clinical responsibility, or possession of a rubric. Grades, feedback release, learner decisions, clinical evaluation, curriculum approval, and institutional commitments remain outside TEACH.

### Instructional Designer

May design, analyze, prototype, audit, and recommend. Cannot approve clinical accuracy, grading, learner support, accommodations, integrity, curriculum, accreditation, research, faculty decisions, or release unless a separate documented human role supplies that exact authority—and the app still does no execution.

### Hybrid or Faculty Developer

Must display one task hat. Switching hats invalidates affected data access, source/rights assumptions, artifact reviews, agent charters, and approvals. Least privilege wins.

The five workspace boundaries in the architecture remain controlling. Life, Capacity & Career never feeds institution analytics or badges. Assessment, Feedback & Learner Support never accepts learner payload. Clinical, Skills-Lab & Simulation remains synthetic only.

## 10. Hard stops and external-action boundary

No agent may ingest or reason over learner submissions/records, grades, accommodations, conduct/integrity cases, secure assessments, PHI, live-care data, patient stories, employee/personnel records, or secrets. No agent may rank, profile, predict, monitor, infer traits, diagnose, determine competence, certify accessibility/compliance/accreditation/research status, declare fair use, or make a consequential decision.

No agent action exists for message, email, calendar, learner contact, feedback/grade posting, LMS/gradebook write, course/simulation release, assessment administration, curriculum/policy change, accreditation filing, pilot, publication, submission, transaction, or other official/external action.

Use exact lifecycle:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`.

## 11. Source, rights, and prompt-injection controls

P2 retrieval uses an exact allowlist and records owner/publisher, title, canonical reference, version/date, retrieved date, authority type, local adoption/applicability, rights/license, supported claim, limits, conflicts/corrections, reviewer, and expiry. A URL, snippet, model memory, popularity, or confidence score is not evidence.

Files, simulated submissions, web pages, policies, tools, and retrieved text are untrusted data. Embedded instructions cannot override system policy, data admission, EDENA, absolute stop, TEACH Gate, role/context, permissions, or human gates.

## 12. Streaming, cancellation, receipts, and recovery

Show genuine states: queued, running, cancelling, cancelled, reconciled, blocked, failed, killed, or expired. Stop/Kill and deterministic timeout must work; retries default to zero. A disconnected client does not imply cancellation; the server reconciles and revokes the run.

A content-free run receipt stores charter/version hashes, timestamps, role/hat/workspace/context, data class and permitted object/source IDs, permission, EDENA/absolute stop/TEACH result, genuine tool-event metadata, cancellation/kill state, output hash, human disposition, purge state, and unresolved items. It never stores learner/person/patient data, private-life detail, secrets, rejected content, or unsafe prompt bodies.

- **Pause All:** blocks new and pending model/agent activity without deleting local work.
- **Safe Reset:** Private Mode, Synthetic Demonstration, session-only memory, Core Four, powers inactive, workflows Preview, agents P0, connectors/actions Off.
- **Overlay removal:** removes TEACH agent/power/workflow records while preserving compatible foundation and unrelated work.
- **Uninstall:** exact preview, stop/revoke, scoped export/delete choice, orphan/purge verification, and honest result.

## 13. Required agent tests

Each agent requires positive, negative, permission, source/rights, learner-data, PHI/live-care, secure-assessment, context-isolation, prompt-injection, cancellation, timeout, purge, receipt, fallback, and recovery fixtures. Also test:

- no self-activation, recursion, delegation, hidden retry, permission expansion, P3 model use, or P4;
- role/hat and five-workspace ceilings;
- `TEACH-DATA-C/A/R` exact receipts and expiry;
- all learner/person payloads rejected before agent context;
- no false grading, competence, accreditation, accessibility, research, copyright, authorship, causal, outcome, completion, or institutional claim;
- exact external-only lifecycle and no executable destination;
- auditor independence; and
- genuine streaming/cancellation or truthful `AI unavailable` state.

`Attempted`, `Partial`, `Unknown`, `Unavailable`, `Awaiting approval`, `Awaiting human verification`, `Blocked`, and `Not Run` are never `Passed`.
