ChatGPT Edu

Penn State AI Assistant & Agentic Tool Access Attestation

This attestation governs use of Penn State–approved AI assistants and agentic tools (“the Tools”), which currently include ChatGPT (Work and Codex) and Claude (Cowork and Code). Penn State supports the responsible, secure, and compliant use of the Tools for teaching, learning, research, service, and operations. By accessing or using the Tools, I acknowledge and agree to the following.

How these Agentic Tools work — read this first

• The Tools act with my access. They can read, change, or transmit files, drives, connected accounts, and systems I am able to reach, including data I did not deliberately provide.

• I am responsible for everything a Tool does under my account, as if I had done it myself.

• Content a Tool reads (web pages, emails, documents, code) can contain instructions that change its behavior in ways I did not intend.

• A Tool can take actions that are hard or impossible to reverse, such as sending, publishing, deleting, or committing.

Eligibility

Individuals with authorized access to Penn State Level 3 (High) or Level 4 (Restricted) data are not eligible to use the Tools.

• This restriction applies whether or not Level 3/4 data is ever entered — because a Tool can reach data through my access, not only through what I type.

• Eligibility is based on the data I am authorized to access, not on what I intend to submit.

• If I gain authorized access to Level 3/4 data after receiving access to the Tools, I will stop using them and notify the appropriate University authority.

Data I will not use with the Tools

Even when I am eligible, I will not enter, upload, or point the Tools at:

• HIPAA-protected health information (PHI) and Individually Identifiable Health Information

• Payment card information (PCI DSS)

• Controlled Unclassified Information (CUI), export-controlled information, or within LionSHIELD

• Federal Student Aid / FAFSA information

• Social Security numbers and driver’s license numbers

• Financial account information or credit card numbers

• Passwords, API keys, security tokens, or other credentials

• For information governed by a contract, NDA, data use agreement, or research protocol, I will follow that agreement’s terms regarding processing in third-party, cloud, or AI tools.

Limiting what the Tools can reach

To limit inadvertent exposure through my own access, I will:

• Give a Tool access only to the specific files and folders a task needs — not entire drives, my home folder, or synced cloud storage roots (OneDrive / SharePoint / Google Drive).

• Not connect a Tool to University systems (email, SIS, ERP, code repositories, ticketing) without approval.

• Review and approve consequential or irreversible actions myself rather than allowing a Tool to act fully autonomously.

Research

• I will comply with all sponsor requirements, grant obligations, data use agreements, security requirements, and research protocols.

• I will not use the Tools for research involving restricted, regulated, or contractually protected information.

• I will consult the appropriate University office when permissible use is unclear.

Output and accountability

• AI-generated output may be inaccurate, incomplete, biased, or misleading; human judgment and oversight remain essential.

• I will review and validate AI-generated output before relying on it.

• I will not use a Tool to make solely automated decisions about individuals — grades, admissions, aid, or employment — where human review is required.

• I remain accountable for all decisions, communications, publications, and work products informed by AI-generated output.

Prohibited uses

I will not use the Tools to:

• Circumvent University security controls.

• Access, disclose, expose, or mishandle University information or systems.

• Violate applicable laws, regulations, contracts, policies, standards, or guidelines.

• Generate fraudulent, deceptive, harmful, or malicious content.

• Conduct unauthorized surveillance or monitoring.

Incident reporting

I will promptly report any suspected data exposure, unauthorized disclosure, privacy or security incident, AI misuse, or policy violation to security@psu.edu.

Acknowledgment

• I have read and understand this attestation.

• I meet Penn State’s eligibility requirements for access to the Tools.

• I understand my responsibilities regarding University information and AI use.

• I will comply with all applicable Penn State policies, standards, guidelines, contractual obligations, and legal requirements.

• I understand that failure to comply may result in loss of access, disciplinary action, contractual remedies, or other consequences as appropriate.