# Safe by Default

**Track:** Engaged Learning — the ij8 platform for schools
**Framework / surface:** ij8 Studio (platform outreach)
**Level:** Trust & safety

**In one line:** Whitelist-first access, roles, cohorts, provider controls, and per-class capability switches — the boring guarantees a district needs first.

## Theory, aesthetics & inspiration

Before a district asks what a platform can do, it asks what a platform will never do. ij8 starts from a closed door. Access is whitelist-first. A student signs in with a Google account or an emailed magic link, and only addresses an administrator has approved can enter at all. Inside, five roles separate powers, administrator, developer, teacher, student, and general user. Governance is separate from capability, so who manages the system and what a class can do are two different dials. Capabilities are explicit. Image generation, video, three-dimensional work, audio, and code are each an explicit policy switch. The student default is deliberately narrow, code only. An instructor opts a class into image or video generation when the curriculum calls for it, not before. Providers are governed the same way. A school can require that all AI calls run through platform-managed keys, forbidding personal accounts entirely. Publishing is opt-in. Student work stays private unless someone chooses to share it, safe by default, public by choice. The scaling design is classroom-shaped. The pilot architecture is sized for ten schools and up to two hundred simultaneous students, the burst of several classes hitting generate in the same minute. The pilot plan budgets student usage, roughly twenty images per active day, so one mischievous class period cannot become a four-figure bill. The privacy posture is stated plainly rather than implied. The pilot program commits to signed data agreements with each district, a student privacy policy, and consent flows where students are under thirteen. And where the platform has gaps, it says so. There is no learning-management-system integration today, and this platform will not pretend otherwise. The same honesty students are taught is the honesty the institution gets. What a district receives, in the end, is legibility. Which students can do what, which providers touch which data, what was made, when, and by whom. Every one of those questions has an inspectable answer. Trust is not a landing-page adjective here. It is a set of defaults you can audit.

**Founder question:** What does your district need answered before the demo?

## References

- [Institutional pilots — procurement, safety & compliance answers](https://pilots.ij8.ai)
- [ij8 Studio — the platform](https://ij8.ai)