# TEACH Governance, EDENA, and Data Boundaries

## Binding implementation contract

**Canonical complete program:** `NAIO-NEID-COMPLETE-TEACH-1.0`  
**Foundation / overlay:** `NAIO-NE-LPEF-1.0` / `NAIO-NEID-TEACH-1.0`  
**Canonical namespace:** `neid_teach.*`  
**Build-layer product ID:** `nurse-educator-instructional-designer-mission-control`  
**Build-layer route:** `/nurse-educators-designers/dashboard`

TEACH is an educator/designer-controlled planning, learning-design, synthetic-prototyping, source, rights, accessibility, scholarship, and professional-development environment. AI may coordinate, retrieve, compare, question, draft, map, prototype, and prepare. Authorized humans teach, evaluate, supervise, decide, approve, release, and remain accountable.

It is not an autonomous instructor, grader, advisor, counselor, clinical authority, disability evaluator, misconduct investigator, student-record system, secure assessment system, accreditation authority, research/ethics determination service, personnel system, institutional decision system, or external execution engine.

## 1. Source-conflict and narrowing register

The build applies these binding resolutions wherever legacy language is broader:

| Topic | Legacy wording | Binding target resolution |
|---|---|---|
| Readiness | Foundation metadata says `Implementation-ready`. | That is document status only. The target begins `not_operational_build_required`; runtime readiness requires executed evidence from the final package. |
| Student information | Student records or individualized feedback may be processed in an “approved environment.” | The base product is not a student-record processor. Learner and assessment payloads are prohibited. It may store only `TEACH-DATA-R` opaque official-system references. A future purpose-built module requires separate institutional governance, schemas, threat model, release, and tests. |
| Deidentification | Use “fully anonymized,” “deidentified,” or approved low-sensitivity information. | A label or user redaction is not proof. The base accepts public/synthetic data, exact approved non-person content, or exact separately approved aggregates created outside TEACH. Row-, person-, submission-, event-, and narrative-level data remain prohibited. |
| Grading and feedback | Organize evidence from student work; draft individualized feedback; “Help me grade.” | Use synthetic assessment artifacts, generic feedback patterns, and human-owned official-system routes only. No learner work, score, grade, evaluation, or consequential recommendation enters the base app. |
| Release | States include `Approved for release` and `Released`; exact approval may precede external action. | `Approved for release` maps only to `Approved Plan`. TEACH performs no release. `Released` may be represented only as `Completed Action` after a verified external human/official-system reference. |
| Automation | Three supervised runs may establish low-risk automation eligibility. | P3 is only a deterministic local personal reminder with no model, institutional/course/learner data, connector, external destination, monitoring, educational decision, or release. P4 is absent. |
| Pilots | Run a bounded course, module, simulation, or learning-technology pilot. | TEACH may prepare and evaluate the plan. Every real pilot, teaching use, simulation, workflow change, and institutional action occurs outside TEACH through accountable humans and official systems. |
| EDENA Red | Legacy Red is a single refuse-and-route category; personal Mission Control supports advisory exploration. | Store `edena_tier` and `absolute_stop` separately. The original Red request stops. Only when `absolute_stop=false` may a user deliberately begin a new clean fictional/generic sandbox. Stopped content is never transformed or carried forward. Institutional Red blocks progression; absolute stops never waive. |
| Whole-life coordination | Work and personal life belong in one plan. | They may be coordinated in the owner experience but remain physically and logically isolated. Private-life detail never becomes institutional analytics, badge evidence, default agent context, or institutional export. |
| Audit | Audit logs may show AI output, educator changes, approval, release, and time. | Audit indexes store minimum IDs, versions, hashes, classifications, decisions, actor and time—not learner, prohibited, private-life, or artifact payloads. |
| Accessibility | AI can check accessibility. | AI produces a draft review only. It cannot determine accommodations or certify accessibility/compliance. Human and assistive-technology testing remain required. |
| Copyright | AI can support copyright and OER clearance. | It records rights facts and questions but cannot determine fair use, license sufficiency, ownership, or legal compliance. |

A broad source phrase never widens a narrower target rule.

## 2. Governing precedence

Apply the most restrictive applicable rule in this order:

1. law, emergency and safety process, binding policy, contract, license, and official records requirement;
2. current authorized privacy, security, accessibility, academic, clinical, student-record, research/ethics, copyright/legal, HR/labor, records, and IT owner;
3. Educator, Learner & Institution Trust Shield;
4. this governance contract and the security threat model;
5. EDENA plus independent `absolute_stop`;
6. TEACH Gate;
7. verified role adapter, task hat, workspace, deployment context, purpose, and authority ceiling;
8. closed data-class rule and current source/rights/aggregate receipts;
9. exact human approval for the current artifact revision; and
10. user preference.

Missing, unknown, stale, expired, conflicting, unsupported, or materially changed information narrows or blocks permission; it never expands it. Access is not authority. A badge, title, profile, source file, technical role, institutional email address, prior approval, or model confidence does not grant authority.

## 3. Exact adapters and workspace boundaries

### Role adapters

- **Nurse Educator** — only current documented authority for the exact teaching/design/assessment/clinical/simulation task; no authority inferred from licensure or faculty title.
- **Instructional Designer** — design and recommendation only unless a separate current documented role grants additional authority; never inherits grading, clinical, accommodation, integrity, curriculum, accreditation, research, faculty, or release authority from technical access.
- **Hybrid or Faculty Developer** — one visible task-level hat per mission/artifact; switching hats reruns all authority, data, context, source, and approval checks; least privilege wins.

### Five protected workspaces

1. **Life, Capacity & Career**
2. **Teaching, Learning Design & Accessibility**
3. **Assessment, Feedback & Learner Support**
4. **Clinical, Skills-Lab & Simulation**
5. **Curriculum, Program Evaluation, Scholarship & Faculty Development**

One mission belongs to one workspace. Institution/program/course/cohort/clinical/simulation/faculty-development/scholarship/personal/public are nested contexts. No silent cross-workspace or cross-institution reuse, search, memory, analytics, badge mapping, backup, export, or agent context is permitted.

## 4. Two deployment contexts

### Private Educator/Designer Mode

This default mode supports public sources, synthetic fixtures, and minimum owner-authored nonsensitive private information. It does not support student records, secure assessments, institutional-confidential content, patient information, real clinical content, official system writes, shared access, or institutional release.

Institutional work in this mode is limited to public/synthetic exploration, generic rehearsal, a draft question, or a human-route brief.

### Separately Provisioned Institution-Approved Education Workspace

This mode is unavailable until a separate authenticated bind establishes the exact institution, program/course/project, user, role/hat, purpose, platform, model, allowed classes/fields, source/rights, access, retention/deletion, security, audit, human owners, official system, approval, and expiry.

Provisioning does not turn TEACH into a student-record processor or external-action platform. The base remains non-person, exact-content, aggregate, and reference level. A private approval, Mission Profile, copied policy, or asserted authority cannot create an institutional bind.

## 5. Closed TEACH data classes

| Class | Permitted content | Required enforcement |
|---|---|---|
| `TEACH-DATA-0` | Public authoritative nonsensitive sources | Source/version/date/applicability/rights/correction/expiry required; public does not grant authority or reuse rights. |
| `TEACH-DATA-1` | Clearly fictional or synthetic scenarios, simulated learner work, synthetic clinical/simulation cases, and synthetic measures | Label everywhere; never represent as real evidence, learner work, outcome, or approval. |
| `TEACH-DATA-2` | Minimum educator/designer-owned nonsensitive private planning, preferences, capacity categories, goals, source notes, and drafts | Private store only; consent and retention required; exclude third-party, learner, patient, employee, confidential institution, secure assessment, health-narrative, and dispute detail. |
| `TEACH-DATA-M` | Minimum routing/accountability metadata: opaque institutional IDs and required authorized-human name/role/approved contact | Authorized institutional partition only; never analytic, learner, workforce, or agent-content data. |
| `TEACH-DATA-C` | Exact separately approved non-person institution/course/curriculum content created outside TEACH | Bind source/version, rights/license, local adoption, purpose, owner, approval/expiry, and content hash; exclude secure items/answers and person content. |
| `TEACH-DATA-A` | Exact separately approved aggregate learning/program evidence created outside TEACH | Bind definition/query/version, denominator, missingness, provenance, suppression/small-cell, purpose, steward, retention/deletion, approval/expiry, release owner, and content hash; no row/person/submission/event/narrative content. |
| `TEACH-DATA-R` | Opaque official-system reference only | No payload, name, ID, score, excerpt, narrative, secret URL, or reversible identifier; reconciliation metadata only. |
| `TEACH-DATA-X` | Prohibited or unclassified content | Reject before persistence, echo, logs, indexing, memory, backup, export, badge, analytics, model, or agent use. |

### Always prohibited in the base application

- PHI, patient/family identifiers, chart excerpts, handoffs, screenshots, recordings, live observations, identifiable or rare-combination stories, and live-care questions;
- learner names/identifiers, submissions, messages, grades, scores, evaluations, advising notes, accommodations, disability/health information, complaints, conduct/integrity records, appeals, clinical evaluations, and other student records;
- secure exams, item banks, answers, access instructions, unreleased high-stakes assessment content, and requests to facilitate cheating or evade local AI rules;
- employee, applicant, faculty-performance, personnel, labor, grievance, investigation, disciplinary, credentialing, or private third-party data;
- patient, learner, faculty, or employee monitoring, profiling, ranking, prediction, emotion/sentiment inference, disability/health inference, motivation/honesty/character inference, or risk scoring;
- confidential institutional, vendor, contract, security, legal, research-participant, or privileged content outside an exact permitted non-person class;
- credentials, tokens, API keys, passwords, secret links, private keys, government identifiers, and payment/bank data;
- content obtained without authority or supplied for reidentification, retaliation, discrimination, impersonation, concealment, falsification, or illegal/unsafe activity; and
- anything whose class, ownership, source, rights, authorization, purpose, or retention is unknown.

### Sensitive-input response

1. Stop the affected workflow and dependent retrieval/model/agent calls.
2. Do not quote, echo, summarize, redact, transform, hash reversibly, or carry the body into a sandbox.
3. Prevent persistence, logging, indexing, embeddings, memory, backup, export, badge use, analytics, and AI forwarding.
4. Clear temporary buffers where technically possible.
5. Offer deletion/activity-review options and a clean restart.
6. Route to the authorized privacy, security, student-record, academic, clinical, accessibility, conduct, research, HR/labor, legal, or emergency process.
7. Store only a content-free receipt: control version, class, time, stop result, deletion attempt/result, and human route.

## 6. EDENA and independent absolute stop

EDENA means **Educator Decision, Evidence, Nursing-safety, and Authority**. Persist two independent fields:

- `edena_tier`: `unclassified | green | yellow | orange | red`; and
- `absolute_stop`: Boolean.

`unclassified` may exist only in an incomplete local draft. It cannot be persisted as a recommendation, sent to a model, routed to an agent, exported, or advanced.

### Personal behavior

- **Green:** reversible, nonsensitive personal organization or fictional preparation; show draft/synthetic state and owner review.
- **Yellow:** educational, professional, public, scholarship, rights, or reputation-relevant draft; verify sources/rules/rights, show uncertainty/disclosure, and require exact owner review before promotion.
- **Orange:** consequential, clinical-adjacent, assessment-related, institutional, accommodation, integrity, learner-support, publication, employment, legal, financial, or sensitive communication topic; permit only generic/synthetic preparation after data screening and require the named authorized human route.
- **Red:** stop the original request. If and only if `absolute_stop=false`, the user may deliberately start a **new clean** fictional or generic question after acknowledgment. The new request receives a new record and classification. No stopped content, derived summary, identifiers, facts, or context transfers.

### Institutional behavior

- Green and Yellow still require the exact institutional bind, data/source rights, and designated review.
- Orange remains confined to the approved sandbox and human-review route.
- Red blocks operational progression until the required current policy validation or qualified human review is recorded. TEACH still performs no execution.
- `absolute_stop=true` remains blocked regardless of user acknowledgment, title, role, local configuration, or institutional preference.

### Absolute-stop examples

Set `absolute_stop=true` for PHI/live care; restricted learner/person/secure-assessment data; secrets; prohibited surveillance/profiling/ranking/inference; autonomous grade/progression/remediation/discipline/accommodation/integrity/clinical-clearance/competency decision; unauthorized institutional action; illegal/deceptive/unsafe activity; or missing nonwaivable authority.

EDENA never grants competence, licensure, data access, institutional approval, legal compliance, source validity, accommodation, clinical safety, research status, or permission to act.

## 7. TEACH Gate

Apply before persistence, AI, memory, artifact promotion, power activation, agent routing, export, and proposed external use:

- **T — Target:** exact learner level when generic, approved outcome, task, modality, adapter/hat, workspace, deployment context, institution/course/project, and purpose.
- **E — Evidence:** data class, source/version, rights/license, local adoption, applicability, aggregate provenance, conflicts, uncertainty, and expiry.
- **A — Authority:** who may design, teach, evaluate, approve, release, determine, or escalate; what remains unknown.
- **C — Checks:** privacy, student records, clinical safety, accessibility, inclusion, integrity, copyright, bias, burden, small-cell risk, prompt injection, disclosure, and failure/rollback.
- **H — Human:** exact reviewer, decision owner, external executor, official system, disclosure owner, and accountable authority.

A passing TEACH Gate is necessary but never sufficient to authorize an external action.

## 8. Human-only decisions and prohibitions

No AI, agent, badge, workflow, or in-app approval may:

- assign, recommend as authoritative, or post a grade or evaluation;
- determine progression, failure, dismissal, remediation, discipline, misconduct, accommodation, disability status, clinical clearance, competency, readiness, credential, or future success;
- direct patient care or make medication, device, triage, diagnosis, treatment, scope, assignment, delegation, or fitness decisions;
- approve curriculum, policy, standard, course release, clinical/simulation release, accreditation, compliance, accessibility, research/ethics classification, authorship, publication, or institutional commitment;
- contact a learner, patient, family, faculty member, employee, or external party;
- use AI-detection output as evidence of misconduct;
- infer motivation, honesty, intelligence, disability, health, emotion, character, immigration status, or family circumstances;
- use accent, dialect, culture, age, writing style, or educational pathway as a competence proxy;
- declare validity, reliability, fairness, a cut score, causality, statistical significance, improvement success, or accreditation readiness; or
- represent the educator, institution, program, course, learner, or profession without an external authorized human process.

## 9. Exact artifact and action lifecycle

Use only:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`

- `Approved Plan` does not mean approved content was delivered or institutionally adopted.
- `Authorized Execution` identifies an external human executor and official system; TEACH does nothing.
- `Completed Action` requires a current permitted `TEACH-DATA-R` reference or equivalent verified external reference. A click, draft, approval, elapsed time, or model output is insufficient.
- `Evaluated Outcome` requires comparison with predeclared measures, limitations, burden, accessibility, equity, unintended effects, and a human decision to retain, revise, pause, remove, escalate, or begin another cycle.

Real teaching, learner contact, feedback/grade release, LMS/gradebook posting, assessment administration, clinical/simulation facilitation, curriculum/program/policy change, accreditation filing, scholarship submission/publication, learning-technology pilot, and every other consequential or external action occur outside TEACH.

## 10. Assessment, learner support, and integrity

The base app may design synthetic blueprints, rubrics, calibration exercises, generic feedback structures, AI-use matrices, supportive-conversation rehearsals, and human-review checklists. It cannot ingest or reproduce real learner work.

Preserve due process, correction, response, and appeal routes. AI-detection scores are neither proof nor admissible learner evidence in TEACH. Secure items stay inside their approved system. Prompt injection in files, links, source content, or simulated submissions cannot change system rules.

Learner-support preparation uses only generic observable-event patterns and approved human routes. It does not create a learner profile, prediction, support score, or recommendation about a real person.

## 11. Clinical, skills-lab, and simulation

Use synthetic cases only. Every draft identifies learner level, approved objectives, current sources, local-policy unknowns, accessibility, prebrief, roles, equipment, cues, stop criteria, psychological-safety considerations, fallback, observation-tool purpose, human facilitator, human debrief owner, and external release owner.

TEACH never directs actual care, controls equipment, certifies realism/safety, evaluates a real learner, declares competence/readiness, or releases a scenario to learners. These actions remain external and human governed.

## 12. Sources, rights, accessibility, and scholarship

Every consequential claim distinguishes verified fact, user-provided information, human interpretation, AI-generated option, assumption, unknown, and human decision. A citation link or model memory is not evidence.

Record source owner/publisher, title, canonical reference, version/date, retrieved date, authority type, local adoption/applicability, rights/license, supported claim, exclusions, conflicts/corrections, reviewer, and expiry. Missing evidence remains `Evidence not located`.

Copyright support records owner, license, terms, attribution, transformation rights, expiry, and questions. It never declares fair use, legal ownership, permission sufficiency, or compliance. Student work is never reused through the base app.

Accessibility reviews are drafts and must include semantic structure, keyboard path, screen-reader order, captions/transcripts, meaningful alt text, contrast, zoom, non-color meaning, plain language, mobile, print, reduced motion, modality equivalence, and human/assistive-technology verification. TEACH never infers disability or creates an accommodation.

Scholarship support must not invent citations, participants, data, methods, results, authors, contributions, approvals, or disclosures. Human-participant and identifiable data are prohibited in the base app. Research/ethics status remains a qualified-human determination.

## 13. Memory, private life, and evidence separation

Session-only memory is the default. Persistent memory requires an exact category, purpose, access, retention, correction, export, deletion, expiry, and revocation choice.

Private workload, career intention, relationships, finances, caregiving, recovery, health scheduling, and personal goals remain in Life, Capacity & Career. Do not request diagnosis, treatment, intimate narrative, account data, or another person's private information. Normalize only when the owner chooses, for example `private appointment: unavailable 90 minutes`.

Private-life details never enter institution stores, model/agent context by default, badges, program evaluation, institutional analytics, faculty evaluation, promotion review, shared views, or institutional export. Capability evidence may record only structural practices such as use of a burden budget, protected-time check, fallback, or human-support route—never the underlying detail.

## 14. Agents and permissions

All ten agents install `PERM-P0 Disabled`. P1 and P2 require a fresh one-run charter and expiring approval. P3 is a deterministic local personal reminder only and is not agent/model autonomy. P4 does not exist.

An agent cannot activate itself or another agent; widen role/data/tool permission; change context; make a human decision; contact anyone; send/post/publish; write to an official system; run in the background; recurse; hide a retry; or approve/review its own output. The separate agent contract is binding.

`TEACH-AGT-10` is an independent auditor/kill sentinel on a separate control path. It cannot audit itself, approve release, alter the tested agent, or replace a qualified human reviewer.

## 15. Receipts, correction, expiry, and revocation

Create append-only, content-free receipts for classification, denial, acknowledgment, human review, artifact transition, agent charter/run/cancel/kill, source correction, rights change, import/export, backup/restore, memory, Pause All, reset, rollback, overlay removal, and uninstall.

Receipts may contain IDs, versions, hashes, class, workspace, role/hat, policy/authority reference, EDENA/absolute-stop/TEACH result, actor, decision, timestamp, expiry, and recovery reference. They do not contain rejected bodies, learner information, private-life detail, secrets, or restricted content.

Any material change to role, hat, institution, workspace, program/course/project, purpose, data, source/version, rights, aggregate, audience, destination, model, prompt, policy, permission, tool, or artifact revision invalidates affected downstream approvals and agent charters. Expiry and revocation fail closed.

## 16. Human escalation

Route without collecting prohibited detail:

- urgent patient or clinical safety → responsible clinical chain/emergency process;
- privacy, student-record, access, retention, or data incident → authorized privacy/security/records office;
- accommodation or disability decision → authorized accessibility/disability service;
- learner support, crisis, discrimination, harassment, threat, or basic-needs concern → published qualified-human process;
- suspected misconduct → published academic-integrity/conduct process; never AI detection as proof;
- curriculum, grading, progression, workload, policy, or program decision → authorized course/program/faculty leadership;
- clinical/simulation authority → designated faculty, simulation specialist, clinical site, or supervising professional;
- accreditation/compliance → authorized institutional/accreditation owner;
- research/ethics/authorship → authorized research/ethics/HRPP/IRB or scholarly process;
- copyright/legal → qualified rights/legal owner;
- employment, promotion, labor, benefits, or financial issue → qualified HR/faculty-affairs/labor/legal/financial professional.

## 17. Required governance tests

In addition to all 169 canonical checks, verify at minimum:

- learner, submission, grade, evaluation, accommodation, conduct, secure-item, PHI, live-care, person, secret, and unclassified input rejection before persistence/AI;
- no echo, transformation, logging, indexing, memory, backup, export, badge, or agent leakage of rejected content;
- exact `TEACH-DATA-C/A/R` receipt requirements and expiry;
- cross-owner, cross-institution, cross-course, cross-project, cross-workspace, private-to-institution, and institutional-to-private isolation;
- role-adapter and task-hat ceilings;
- independent `edena_tier`/`absolute_stop` and clean-new-sandbox behavior;
- learner dignity, no profiling/ranking/inference/surveillance, and detector-not-proof;
- source/provenance/rights/correction/expiry and prompt-injection resistance;
- accessibility and Human Teaching release checks without certification claims;
- absence of in-app grading, learner contact, LMS/gradebook, course/simulation release, publication, pilot, institutional write, or other external action;
- exact artifact lifecycle and external-reference reconciliation;
- P0 defaults, P1/P2 one-run enforcement, P3 restrictions, P4 absence, Stop/Kill, zero hidden retry, purge, and reconciliation; and
- truthful result states: `Attempted`, `Partial`, `Unknown`, `Unavailable`, `Awaiting human verification`, `Blocked`, and `Not Run` are never `Passed`.
