Before You Hand Over the Keys: Using AI Agents Safely in School Psychology
Key Takeaways
An agent’s harness is the practical setup that defines its assignment, tools, permissions, working space, approval points, and stopping rules.
Do not allow an agent to access student information unless your organization has explicitly approved the specific tool and use through appropriate technology, privacy, security, and administrative review.
Begin with the least authority needed and keep consequential actions under human control.
A separate working folder can limit what the agent can reach, although it does not remove every risk.
School psychologists remain responsible for reviewing sources, checking accuracy, interpreting context, and deciding whether the final work is appropriate.
In the first post in this series, I described an AI agent as AI with arms. Those arms may allow it to research on the web, create documents, organize files, use applications, and—when broadly authorized—operate much of a computer in ways that resemble what a person can do.
That ability to act is what makes agents useful. It is also why familiar concerns about accuracy, privacy, security, and professional responsibility become more consequential. A chatbot can give you a poor answer. An agent may be able to act on a poor answer.
The practical question is therefore not simply, “How capable is the AI?” We also need to ask what it can access, what actions it can take, what rules it must follow, and when a person must review its work. This post explains the structure surrounding an agent and offers a cautious starting point for school psychologists.
What Is a Harness—and Why Does It Matter?
The word harness can sound technical, but the idea is practical. An AI model is the part that interprets language and reasons through a task. Common model families include GPT, Claude, and Gemini. The harness is everything around that model that determines what it can see, what its arms can reach, what rules it must follow, and when it has to stop.
Think again about the intern analogy. The intern is one part of the arrangement. The assignment, office keys, computer access, locked filing cabinets, supervisor’s instructions, and requirement to obtain approval are the harness. They determine what the intern can actually do.
An agent’s harness includes:
The model: The part that interprets language and reasons through the task. Common examples include GPT, Claude, and Gemini.
The assignment: What exactly is the agent being asked to accomplish?
Instructions: What steps, standards, and rules should it follow?
Tools: Can it browse the web, create a Word document, use an application, send emails, or operate parts of a computer?
Permissions: Which folders, websites, accounts, or applications may it use? What may it read, create, change, send, or delete?
A designated working space: Where may it work without reaching into unrelated files or systems?
Human approval points: Which actions must stop until a person reviews and approves them?
Memory: What information may it retain for later, and what should it forget?
Stopping rules: How does it know the assignment is complete or that it needs help?
A record of its actions: Can a person review what it did, which sources it used, and where it encountered problems?
You do not need to design every part of this setup by yourself. AI can help you think through the task, draft instructions, identify needed tools, propose approval points, and create stopping rules. Also, a lot of these are built into things like ChatGPT work. You still need to review those choices and decide what access is appropriate. A later post in this series will go more deeply into how to direct an agent and give it useful instructions.
The same AI model can be relatively limited in one harness and extremely capable in another. One setup may permit it only to answer questions. Another may let it open applications, move files, research on the web, draft documents, enter information into websites, or have full control of your computer. That difference is why the harness matters so much.
For school psychologists, this setup should reflect the same professional values we bring to other systems: confidentiality, competence, transparency, documentation, human accountability, and giving the agent no more access than the assignment requires.
Protect Student and Client Information
Do not allow an agent to access student information unless your school, district, university, agency, or other organization has explicitly approved the specific tool and the specific use. That approval should include the appropriate information-technology, privacy, security, and administrative review—not simply an individual user deciding that the tool seems safe.
For most school psychologists, that kind of approval is unlikely to be in place right now. The safest assumption is therefore that student records and personally identifiable student, client, patient, or family information are off limits. Removing a name does not automatically make a case nonidentifiable.
That still leaves many useful possibilities. Begin with public information, fictional scenarios, synthetic data, professional resources, or your own nonsensitive materials.
Begin with the Least Authority Needed
An agent that only needs to summarize public research should not have access to email, confidential files, or student records. Start with read-only access when possible. Keep sending, posting, deleting, purchasing, and other consequential actions behind explicit human approval.
Permissions should match the assignment. If an agent only needs to read three public documents and prepare a summary, it does not need access to your complete computer, cloud drive, email account, or contact list.
Give the Agent a Safe Working Space
A safe working space can include a separate folder, computer or, for some low-risk tasks, a dedicated email address. The purpose is to give the agent access to only the public or nonsensitive materials it needs without opening your personal or organizational accounts.
A Separate Working Folder
For many beginners, the simplest version of a sandbox is a dedicated folder created specifically for the agent’s assignment. Put copies of only the materials the agent needs in that folder, and limit the agent’s access to that location whenever the system allows you to do so.
For example, an agent organizing public professional-development resources might receive access to a folder called `AI Training Materials`. It would not need access to your entire Documents folder, email account, cloud drive, or student records.
A Dedicated Email Address for Public or Nonsensitive Work
For some low-risk tasks, it may also help to create a dedicated email address used only for the agent’s public or nonsensitive work. Public newsletters, research alerts, or other approved materials could be sent there. You could then search and review that inbox without giving the agent access to your personal or organizational email. The same privacy rule still applies: do not send student, client, patient, or other confidential information to that account.
A separate folder and email does not make every risk disappear, and more advanced systems may use stronger technical isolation. But the basic principle is easy to remember: give the agent a small, clearly identified place to work rather than the keys to everything you can access.
Plan for Prompt Injection
Agents may read webpages, documents, emails, or other outside material. Those sources can contain instructions—sometimes malicious ones—designed to manipulate an AI system. This is known as prompt injection.
For example, an agent reviewing a webpage might encounter hidden or visible text telling it to ignore the user’s instructions, disclose information, or take an unrelated action. That is one reason agents should not treat outside content as trusted instructions. Tool access should be limited, sensitive actions should require approval, and unusual requests should cause the agent to stop rather than improvise.
The OWASP guidance on agentic AI security provides a useful overview of risks involving goal manipulation, tool misuse, excessive permissions, and other failures.
Preserve Human Judgment
An agent may produce polished work that is incomplete or wrong. It may also complete the wrong assignment very efficiently.
The professional remains responsible for reviewing sources, checking accuracy, interpreting context, and deciding whether the final work is appropriate. Agents can support professional judgment; they should not be used to bypass it.
This continues a theme I have addressed in earlier posts on ethical AI guidance for psychologists and practical AI prompting for school psychologists: useful AI requires clear expectations and meaningful human oversight.
A Practical Starting Point
A cautious first agent assignment should use nonsensitive information, involve limited tools, and produce something that a person reviews before it affects anyone else. For example, an agent might organize a collection of public professional-development resources in a separate folder and prepare a proposed index for review.
Before allowing the agent to begin, ask:
What information does it actually need?
Which tools and folders may it use?
Which actions are prohibited?
What must a person approve?
How will I review what it did?
What should cause it to stop and ask for help?
The goal is not to remove professional responsibility. The goal is to make the agent’s assignment, access, and limits visible enough that professional responsibility can be exercised meaningfully.
If you would like to hear more about this topic, you can also listen to the first episode of Beyond the Bot Episode 1, my podcast about AI agents.
Stay tuned for the next installment, Goals and Loops: How to Give an AI Agent a Job Without Losing Control. It will explain how a clear goal, repeated steps, checks, approval points, and stopping rules help an agent work toward an outcome without simply continuing forever. A later post will go more deeply into how to direct an agent and write useful instructions, followed by a closer look at the research-to-practice agent I have been developing.
Final Takeaways
Treat the harness as the agent’s safety plan, not as a technical afterthought.
Assume student and client information is off limits unless the specific tool and use have received explicit organizational approval.
Match tools and permissions to the assignment and require human approval for consequential actions.
Give the agent a small, clearly identified place to work and maintain a reviewable record of what it did.
Use agents to support professional judgment, never to bypass it.
AI Disclosure: Generative AI was used to assist with drafting and editing this post and to create the accompanying image. I reviewed and revised the content and take responsibility for its accuracy and final form.