AI in School ERPs: How to Tell Governed Intelligence from a Chatbot Bolted On

The demo trick

Most 'AI in ERP' features are built the same way: a copy of the school's data is sent to a general-purpose model, along with the question, and the model writes an answer. It is quick to build and it demonstrates well. It also has three properties a school should not accept. The copy is outside the permissions that govern the original. The answer is generated from that copy, so it is only as fresh as the last sync. And the exchange happens outside the audit trail, so a question about a named student's fees leaves no record that it was asked.

None of this is visible in a demo, because the demo is run by the vendor, on the vendor's data, with the vendor's account. The way to see it is to ask five questions and insist on seeing, not hearing, the answers.

Five tests that cannot be faked

Run these with your own roles, in the vendor's sandbox, during the evaluation. Each one takes a minute and each one has a right answer that is easy to check.

• Scope: log in as a class teacher and ask about another class's fee defaulters. Governed intelligence declines, because the teacher's role cannot see that. A bolted-on chatbot answers, because the copy has no roles.
• Source: ask a question and then ask 'which records did you use?'. Governed intelligence points at the records, with a link the role can open. A chatbot restates the answer.
• Freshness: change one attendance mark, then ask the question that depends on it. Governed intelligence reflects the change now. A chatbot reflects it after the next sync, if there is one.
• Audit: ask the vendor to show the question you just asked in the audit log, with your name and time against it. If it is not there, nothing you ask will ever be there.
• Tenant: ask, in writing, whether your data is pooled with other schools' data anywhere in the answering process, and whether it is used to train anything. The answer belongs in the contract, not the demo.

What 'inside the system' actually means

Intelligence that lives inside the system reads the same role graph, timelines, fee state and communication trail the institution already runs on. It does not have its own copy. When a trustee asks which campuses are behind on collections, the answer is computed from the live ledger, scoped to what a trustee is allowed to see, and the question itself becomes an entry on the audit timeline beside the approvals and overrides it may lead to.

The practical consequence is that the intelligence inherits the institution's governance rather than bypassing it. Every control the school negotiated for the platform, role scope, tenant boundary, audit, data residency, applies to the answers too, because the answers are produced by the platform. That is what makes it usable for the questions that matter, which are almost always about money, named people and exceptions, exactly the questions a school would never put to a general chatbot.

A worked question

A trust administrator asks: which campuses have fee collections drifting this term? A governed answer says two of six campuses are behind plan, names them, shows the collected-versus-planned figure for each, and offers the next steps the role can take: queue a reminder circular, review concession approvals at the campus that has issued the most, flag the pattern for the principal. Each next step is a workflow with an owner, not a suggestion in a chat window. The question and the answer are logged. If the same question is asked by a campus principal, the answer covers one campus, because that is the principal's scope.

That is the standard to hold every vendor to. Not whether the assistant can write a sentence, but whether the sentence came from live records, inside the asker's role, with a record that it was asked.

Questions for the vendor, in writing

Put these in the evaluation questionnaire and ask for written answers. They are short, they are checkable, and a vendor who has built intelligence inside the system will be glad to answer them.

• Does the AI read live records, or a copy? If a copy, where is it, how often is it refreshed, and who can access it?
• Are answers scoped by the asker's role, using the same permissions as the rest of the platform?
• Is every question logged on the audit trail with user and time?
• Can an answer show which records it was drawn from?
• Is our data pooled with other institutions' data, or used to train any model, and where is that stated contractually?
• Can the AI take actions, or only answer? If it can act, under whose approval?