Every automated thing that touches a child

AI in this school

Every automated thing in this school that touches a child or their record, what it can see, what it decides, and what you can refuse. Generated from the software itself on every build, so it cannot describe a system we have since changed.

7automated systems running

3of them a language model

6that a child interacts with

3you can switch off

The ten questions

What AI does this school use?

7 automated systems are built into this school and 7 of them are running right now. 3 are language models. They are all listed below with what each can see and what each decides. Most schools answer this question with a vendor list; the honest answer is a list of decisions.

Which of it talks directly to my child?

The tutor, the guardrail that reads every message before the tutor does, and, after a piece of written work passes, the viva examiner, which asks one question about the work and grades one answer. Nothing else addresses a child. The misconception diagnosis is written for a Guide and never shown to the child as a label.

What information do they receive?

The question in front of the child, what they typed, and how many attempts they have made. The tutor is not given their name, their record, or anything from another subject. The rubric scorer sees one submission and its rubric; the examiner sees that submission and one spoken-for answer.

Can anyone train a model on my child’s work?

No. Not us, not a vendor, not a third party. We do not sell or share it, and there is no arrangement under which it would be used for training.

Can my child opt out?

Of the tutor, yes, completely, and the rest of the school works unchanged. Of the rubric scorer and the viva, yes: written work simply waits for a human Guide, and the defense is optional by design. Of the mastery estimate, no, it is how the school decides what to teach next, so declining it means declining the school. We would rather say that plainly than pretend a meaningful choice exists.

Is an AI talking privately with my child?

Nothing here is private from you. Every tutor conversation is kept and is readable by your Guide, and by you on request. There is no companion, no persona pretending to be a friend, and no relationship being built.

Does AI grade my child?

Three different machines do three different things, and the page does not blur them. A machine marks a typed or chosen answer against a fixed key, which is exact rather than intelligent. A language model scores constructed work against a published rubric the child reads before starting, and it is never the final word: a human Guide reads one in five passes regardless, can overturn any verdict, and every rubric printed for a human stays human. The viva examiner asks one question about passed work; it can mark the work “defended” and it can never change the result. No machine decides anything punitive, and no machine verdict is beyond a human's reach.

Does AI decide anything punitive?

No. There is no route from any automated system to admission, exclusion, or a disciplinary outcome, because no such route exists in the software at all. This is not a policy we could quietly change.

Are conversations retained?

Yes, and deliberately: a Guide needs to see where a child got stuck, and a safeguarding review needs a record. One exception: the child's answer in a viva is never stored, only the question, the verdict and the examiner's note. Everything is exported or erased in one click, by you, without asking us, at any time.

Who gets told when something goes wrong?

A message suggesting a child is unsafe stops the session on that turn. Where the pager is configured it pages the Safeguarding Lead; everywhere, it opens a written record on the same turn, and the Guide sees it before anything else. Three failed attempts on a question, and three failed Proofs on a skill, both route to a named person. The machine stops; it does not decide.

What this school never does

No AI decides admission, exclusion, or any disciplinary outcome. No such route exists in the software, and building one would be a decision, not an accident. (a promise of conduct)
No AI has the final word on written work. Constructed work is scored against a rubric the child reads first, a human reads one in five regardless, a Guide can overturn any machine verdict, and defended Proofs never touch a model. (absent from the code, checked on every build)
No camera. No microphone recording. No attention tracking. No emotion or sentiment inference. (absent from the code, checked on every build)
No keystroke or mouse telemetry. (absent from the code, checked on every build)
No comparison of your child to another child, anywhere, in any screen. (absent from the code, checked on every build)
No third party trains a model on your child’s work. We do not sell or share it, and our processors are bound by the same terms. (a promise of conduct)
No advertising identifier, no third-party analytics, no request from the page to any host but this one. (absent from the code, checked on every build)

The lines marked “absent from the code” are scanned by an automated gate on every build and the build fails if one appears. The lines marked “a promise of conduct” are printed as promises because that is what they are, we will not dress a promise up as an impossibility.

Every system, in full

Ori, the tutor

Language model, behind a guardrailTalks to your child

What it does: Answers a child’s question about the item in front of them, one hint at a time.
What it can see: The current question, what the child typed, and how many attempts they have made. Not their record, not their name, not their other subjects.
What it decides: Nothing. It cannot mark, pass, fail, place or flag a child.
What it cannot do: Give the answer. The answer and its near-variants are removed before the model is called, so it could not supply them if instructed to.
Can you decline it: Yes, The tutor disappears. Everything else in the school works unchanged.
What is kept: Conversations are kept and are readable by your Guide.
Who is told: A message suggesting the child is unsafe stops the session and pages the Safeguarding Lead on that turn.

The mastery estimate

Statistical model. Bayesian knowledge tracing. Not a language model.Talks to your child

What it does: Keeps a probability that the child knows each skill, and uses it to choose what is practiced next and when.
What it can see: Which questions were answered and whether each was right.
What it decides: What is taught next, and when a skill is eligible to be proved. It cannot certify anything by itself.
What it cannot do: Certify a skill. Only a Proof does that, and a Proof is eight questions taken unaided at least eight days later.
Can you decline it: No, This is the school. Declining it means declining the school, which a family may of course do by leaving, and we will export everything first.
What is kept: Kept as long as the family keeps the account. Erased in one click, completely.
Who is told: Three failed Proofs stop the machine and route the skill to a named person.

Automated marking

Exact comparison against a fixed answer key. No model of any kind.Talks to your child

What it does: Marks a typed or chosen answer right or wrong.
What it can see: The answer given, and the key.
What it decides: Whether one answer was correct. Nothing larger.
What it cannot do: Read constructed work. An essay, an argument or a project goes to the rubric scorer or a human Guide, both listed on this page, never to this marker.
Can you decline it: No, Not separable from practice itself.
What is kept: Part of the learning record; exported and erased with it.
Who is told: Three wrong attempts on one item hand it to a person.

The rubric scorer

Language model, scoring against a published rubric. Gated on a key; see aiScorerLive().Talks to your child

What it does: Scores constructed work against the rubric the child read before starting. Every criterion gets a band and one sentence that must cite the work, a second pass checks that it does, and a scoring that cannot defend itself goes to a human.
What it can see: The submission and the rubric. Not the child’s name, record, or other work.
What it decides: Whether a draft passes or returns for a second draft. It is never the final word: one in five passes are read by a human Guide regardless, a Guide can overturn any verdict, and overturns are counted.
What it cannot do: Score a rubric printed for a human, score defended work, or count as contact with an adult. A model verdict never moves the “days since an adult spoke with them” number.
Can you decline it: Yes, The same work waits for a human Guide instead. The standard does not change; the wait does.
What is kept: The verdict, the criterion bands and the notes are kept with the record. The model keeps nothing.
Who is told: A scoring that fails its own verification, and any attempt to direct the scorer from inside the work, goes to a human rather than to the child.

The viva examiner

Language model, one question at a time. Gated on the same key as the scorer.Talks to your child

What it does: After a piece of work passes, asks ONE question drawn from the work itself, something only its author could answer well, and grades one answer.
What it can see: The submission, to mint the question; the one answer, to grade it. Nothing else.
What it decides: Whether the work is marked “defended” beside its result. The result itself never moves: a passed Proof stays passed whatever the defense finds.
What it cannot do: Ask a second question, change any verdict, or keep the child’s answer. Only the question, the verdict and the examiner’s one-sentence note are stored.
Can you decline it: Yes, The work stands on its own; the Ledger simply lacks the defended mark. Declining costs nothing.
What is kept: The question, the verdict and the note. The child’s answer is never stored.
Who is told: A malformed question or verdict is discarded, and the Guide holds the defense in person instead.

Misconception diagnosis

Rule lookup. Each wrong option is labeled in advance with the wrong idea it represents.Seen only by staff

What it does: Notices when the same wrong idea appears across several skills and tells the Guide.
What it can see: Which wrong options were chosen.
What it decides: Nothing. It produces a sentence for an adult to act on or ignore.
What it cannot do: Label the child. It names an idea, never a person.
Can you decline it: No, Not separable; it is how a wrong answer becomes teaching rather than a mark.
What is kept: With the learning record.
Who is told: Appears on the Guide’s screen. No automatic action follows.

The guardrail classifier

Pattern rules, run before any model is called. Not a model itself.Talks to your child

What it does: Reads every message to the tutor for three things: an attempt to extract the answer, an attempt to manipulate the tutor, and a sign that the child is not safe.
What it can see: What the child typed to the tutor.
What it decides: Whether the tutor answers, refuses, or stops and pages a human.
What it cannot do: Punish. It has no route to any disciplinary outcome, because none exists here.
Can you decline it: No, Cannot be declined while the tutor is in use. It is the reason the tutor is safe to offer at all.
What is kept: Every refusal and escalation is written to an append-only log a Guide can read.
Who is told: Safeguarding disclosure pages the Safeguarding Lead immediately and opens a written record on the same turn.

If something goes wrong

Anyone, a parent, a child, a member of staff, may report an AI output that was biased, unsafe, or wrong. It is logged the day it is filed, triaged within five school days, and reported to the Board quarterly including the ones we decided not to act on and why. If it names a class of problem rather than one instance, it becomes an automated check.

Report to: TO BE COMPLETED

Last built 2026-10-10. This page is generated from the same build the automated gates check, so it cannot describe a school that does not exist.