A school district wants to fine-tune a homework helper on student essays, but data-handling rules for the training set are unclear. What should security require before customization proceeds?

Fine-tuning a school-district homework helper on student essays implicates education-sector data-governance constraints: student work can be education records or otherwise protected personal data. Security should require minimization, authorized purpose limitation, access controls, retention limits, and documented lawful use of the fine-tuning corpus before customization proceeds. Unclear handling rules are a stop-ship condition, not a paperwork backlog to clear after weights are updated.

Uploading raw essays to a public demo workspace for vendor onboarding is an exfiltration and compliance failure. Treating student essays as public domain because they were written for class credit is legally and ethically incorrect in typical K-12 governance. Disabling access logging to encourage teacher contributions removes accountability precisely when sensitive training data is being assembled.

Exam caveat: Domain-adaptive fine-tuning does not create a carve-out from student-data rules. Candidates may confuse open educational resources with individual student submissions. The correct path is governance-first corpus preparation, not speed-to-vendor demos.

Operational check: Classify the essay set under district policy, obtain authorized use approval, strip direct identifiers and unnecessary metadata, store the corpus in a controlled training environment with logging enabled, and record retention and deletion commitments. Only then permit fine-tune jobs, and verify post-tune that sample generations do not reproduce identifiable student prose beyond approved educational use.