Don't block shadow AI on campus. Out-design it.

So, universities have been asking for the last few years, how do we stop students and faculty from using unsanctioned AI? We think that's the wrong question. That's one I actually posed to Michael a few months ago, which is why we're here today. The better one rather is, how do we make the university's own AI experience useful enough so that the students will choose it over a generic chatbot? Right. My name is Michael Hacker. I'm from Montclair State University. And with me today is Michael Kowal from Cloudflare. Go. All right. So, let me make this concrete. A student can do everything we ask of them. They can apply. They can get admitted. And then, of course, they can say, yes, we hope, right? The university hands her a financial aid form, health record forms, tuition plans, housing choices, deadlines, the list goes on and on, right? They're spread across systems that the student has never seen and definitely has never used before. Research calls the result of this summer melt. 10 to 20% of all students who intend to enroll never make it to day one. That's according to Brookings. This is not a motivation problem. This is really just a navigation problem, right? For the institution side, it's easy for us, right? Every task has an owner, a document to process. It's meant for the back office, right? But from the student side, the questions are more simple. Am I clear to start? What am I missing? Who can help me today when I have a problem? That gap that exists right there is where an admitted student can quietly disappear. So, the university already has most of the answers. I know we do. The degree audit system knows what Maya needs to graduate. The LMS knows, you know, what is due this week, what assignments she's missed, right? The ERP knows why she has a balance. But Maya, she has to know the vocabulary, the URL, the owner, and then the sequence of events on how to actually get to it. More than 35% of surveyed students were unaware of critical support services that were available to them. That's according to Titan Partners. A service that cannot yet be discovered is not yet a student outcome. Each system can be technically correct, and usually is. But the combined experience still fails the student. Our systems just are optimized for offices and workflows. But we have an opportunity here to reorganize the experience directly around the student. Students already have generic AI. Banning it does not create a better experience for the student. It creates a detour. Generic AI can explain what a degree audit is, but it cannot say why Maya is, we'll say, authorized without a, I'm sorry, but without an authorized university integration, it cannot safely use Maya's actual record to be helpful for her. It can suggest that she call financial aid. It cannot explain her specific hold. It cannot find her missing documents. It cannot check what open sections are open according to her schedule, right? Her work schedule or something else going on in her life. That's the inversion we're talking about. Universities will not win by making public AI less available. They can win by making institutional AI more useful. Useful does not mean unconstrained, right? And that's important. It means answering with the student's permission, showing where the answer came from, and moving her to a person where judgment is required. Let us show you what that looks like. So meet Maya. She is a first-generation transfer student. She lives on campus. She works 20 hours a week and wants to graduate next spring. Registration opens today and she has a hold. Everything you're about to see is all made up. It's all fictitious and uses synthetic data. Michael is going to drive this live for us. All right, let's switch over to demo. Thank you. All right, guys, so we're going to give a quick demo as to what Maya's experience is when she uses this new system. This is the demo here. This will be the best demo you've seen all day. Just take it from me, okay? So here what you guys are looking at, if the glare is not too much, is a university AI workspace that they built using Cloudflare OS, which is an open-source project and a bunch of other Cloudflare services, which we'll talk about later. So what Maya does, what we haven't seen yet, is that Maya has authenticated first and foremost to the system. So we see up here Maya is authenticated, and now we get some context around who Maya is. So Maya is a student. She's a business analytics major. She has 108 credits left. And because we've authenticated her, we also see a list of MCP servers that she has access to. Not everything, only a few certain ones. We'll get into that in a second. So Maya, as Michael mentioned, Maya's going to enter a prompt in here that says, Registration opens today. I have a hold. I work Tuesday and Thursday evenings, and I want to graduate next spring. What do I need to do? And she kicks that off into the prompt, and you can see these MCP servers are being hit. And right off the bat, the system acknowledges, yeah, okay, we're good for next spring graduation. We're on track for that. And the first bit of information we get is, it acknowledges the fact that she does have a hold, and it started to dig into what's the story there, that she has $1,200 that she owes. There's an $1,100 financial aid. However, that's being held up because she hasn't submitted a form. Well, what is that form? The system actually pointed that out for her. This is a residency verification form that she can click on and start filling out. So it's been easier for her. The next thing that the system did was it was able to dip in and perform a degree audit to figure out, you have three requirements left. Do you want to graduate next spring? And it understood her constraint that she was working Tuesday and Thursday night, so it built a conflict-free schedule around that. So it suggested a couple classes there for her. And the third and final thing, which I think is probably the most important thing, is that the system said, hey, I'm recommending you guys your schedule, but what you should do is speak to the human inside the value chain to validate that. So what is that? That's her advisor. Well, who's her advisor? It figured that out, Mr. Jordan Lee, and it went to a calendar MCP server and it figured out that Jordan has a time slot next 1130. Tomorrow, she can just click this link here. And then that was just a simple call, which actually ends up being a calendar hold on Jordan's calendar. Okay, so Maya still has a little anxiety around this whole hold on her financial situation. So yes, an additional question here. How or who should I submit the form to exactly? So she kicks that off, and she gets a response that tells her, hey, here's the site you need to go to. Here's how to navigate that tree. By the way, it actually scraped data on their operating hours and it figured out, hey, if you fill this out today and submit it before 3 p .m., they're probably gonna process it same day. And if you have any problems, it actually figured out the phone number for her. So it really anticipated how to move her through this process. So Maya's good now. She knows what she needs to do, but she wants a little more information about the schedule that was suggested to her. So she asks, can you show me a detailed class schedule, including where each class meets and how long it will take me to walk there from my dorm? Now, notice here, she doesn't specify where her dorm is. The system will figure that out, right? Because it's gonna miss that, and it'll start looking at another MCP server to figure out where she lives. So she submits this. You can see on the right-hand side, we hit another number of MCP servers. And let's walk through this data together. So here it tells us the classes, what days they are, where they are, and how long it will take for her to walk from her dorm to the building because it dipped into a campus map MCP server. But look at this bottom one here, econ. This is pointing out that this building is on a totally different campus, all right? So the system said, oh, there's no possible way she's gonna walk there in time. So it dipped into the campus bus scheduling and payment system. And it figured out that she needs to take the B bus. And it figured out that if you leave your room by this time, you can get to the bus stop by that time. It'll take 12 minutes for the bus to get to the other campus. So it figured out all the logistics for her. And then it took it a step further because that bus MCP server also does payment. And it figured that, hey, next semester, you're gonna be on that bus about 60 times. So doing the math, that's gonna be 75 bucks. On your bus card, you have the $18. So if you want, click this link here and top up your credits there. So to wrap this up, she then says, well, after I'm done with the econ class, how do I get back to my room? And then she submits it. And we already have access to the campus transit MCP server. So it just tells her the details there. So we'll swap back to the slides, if you guys don't mind. And what I wanna go over is, so this is the, we're not seeing the stuff down here. So what we're looking at here is this is the architecture for what you just saw. So what happened in, what I find interesting was that when Maya asked the initial question, she ran into, we ran across numerous systems. So like financial aid, registrar, campus map systems, et cetera. So there were a number of things there. The first component to this architecture is the identity piece, right? So this is provided by Cloudflare Access. This allows us to authenticate Maya so we can get context around who she is, as well as we wanna govern what tools she has access to. The next piece is the workspace. So that was built on top of Cloudflare Workers using the front end that you guys saw was a customized version of Cloudflare OS, which is a open source tool that was published by Cloudflare. This third piece over in the top right-hand corner, that is the governed access. So all of the model requests will get routed through a Cloudflare AI gateway, which is hosted in the cloud. And that allows the university to control, let's say, what model providers are able to use. We can provide cost controls. If the university wants to do more data loss prevention or add additional guardrails, that's all available inside the AI gateway. One good use case is students get access to open weight models and more senior people and staff get access to better models. That can be one thing. And then finally, the fourth piece of that architecture is the MCU server portal, which is governed access to the tools. So again, Maya access some parts of the registrar, some parts of financial aid, and we wanna restrict what she can and can't do. We don't want her accessing HR, payroll, or student information system that lets her change her grades. Or, I don't like this kid in my class, let me go change the roster, right? We wanna block all that. So that is easily done within the MCP portal server. So I'll hand over to Mike now, who's gonna talk about, I guess, the safe path. Thank you. So every campus security leader should be asking, after seeing something like this, do we just hand an AI agent access to student and financial data, plus the power to act? That's the right question, right? As a former CSO, I'd say that that's one of those things that keeps me up at night, right? The unsafe version of this gives the agent broad access credentials and unchecked authority, right? The pattern you just saw that Michael demoed here, that is narrow and explicit. It's retrieved the minimal authorized data, cite where it came from, right? Explain it, propose the next action, confirm anything consequential with the student itself or themselves, and then execute through a scoped tool a record what happened, right? So sequence of events. In the demo, the exposed tools cannot remove a hold. Can't, right? It can't accept financial aid because we don't want it to, right? It's not going to pay a bill or change enrollment, again, like Michael said, right? After Maya confirmed the appointment that happened outside of the models tool surface, the application created a one-time approval bound to her identity, which is incredibly important for that exact time slot, right? And the service itself checked it again before writing. Swap degree audits for claims history or an account record, and the same pattern applies anywhere regulated data and human consequences meet. So Maya's registration question is one moment in a longer journey for a student, right? And those of you who are educators or work in education, you understand that. Before day one, that same workspace that we just showed you can surface a missing enrollment task and reduce the summer melt that we talked about in the earlier slides. During the semester, it can connect assignments, tutoring, you name it, basic needs support. And before graduation, what it can do is it can connect degree process, or progress rather, to internships, to career opportunities through applications like Handshake. We should be careful with the claim, however, right? An MCP portal does not automatically increase enrollment or create better graduation outcomes because it doesn't, right? But there's direct evidence that institutionally aware AI guidance can move that number. And that's the important part. In a randomized study, Georgia State's Pounce Chatbot increased fall enrollment among intending students by 3.3 percentage points. The mechanism was not magic. It used the institutional data that already existed to help students complete real tasks and escalated exceptions to people, again, keeping humans in the loop, right? The design choice that matters is continuity. A student should not have to rediscover the university or the school or your environment year after year, semester after semester. Arrive, persist, graduate, launch. It's one understandable path that doesn't matter as services change. So do not start by connecting every university system. Pick one student moment. Choose one with a favorable, measurable failure rate, right? Registration holds are always a good first choice. Something we're looking at. Connect to or through authoritative systems. Start with read -only. Again, take the safe path. And add exactly one confirmed action, usually scheduling help. Then you're gonna measure completion time, successful handoffs. You're gonna look at student satisfaction against the baseline that you took before kicking off the project. You're going to define the boundary before writing any code. Whose identity is authoritative? Which records each tool may return? Which actions still belong to a human? Again, keeping human in the loose. The technical pilot can and should be small. The institutional learning, what context actually helps and where judgment stays human, that's the valuable part. If students still leave the workspace to ask a public chatbot, regardless of what flavor it is, treat that as product feedback, not a policy violation, right? And learn from it. So the future campus is not one with the most portals. It is the one where a student can ask for help without first understanding your org chart, your policies, your procedures. Public AI will always be one click away. Even if it's not on your network, it'll be on their cell phone. So the winning strategy is not to make it harder to reach. It's to make our own university's experience more useful for the student, more trusted for the student, and better connected to the outcome that they came for. So do not block Shadow AI. Outdesign it. Thank you. Yeah, thank you. Thank you.