# FERPA / COPPA boundary matrix (EdTech on AWS 2026)

| Data class | Example fields | Store | Access control | AI boundary |
|------------|----------------|-------|----------------|-------------|
| Directory info (FERPA) | Name, grade, school | Aurora / DynamoDB | IAM + app RBAC | Allowed in tutor with topic guardrails |
| Education records | Grades, submissions, IEP refs | Aurora CMK | Row-level by `tenant_id` + `course_id` | **No** raw export to Bedrock without de-ID |
| COPPA child account | Birthdate, parent email | Cognito + separate child pool | Parent consent workflow | Block PII in prompts — Guardrails sensitive filter |
| Analytics aggregate | Engagement scores | S3 + Athena | Lake Formation tags | OK if k-anonymity ≥ 10 |

## Opinionated default

**Separate AWS account per large district** (or OU with SCP) when mixing K-12 and higher-ed on one platform. Use **Bedrock Guardrails** denied topics + PII filters on all tutor paths ([Guardrails docs](https://aws.amazon.com/bedrock/faqs/)).

## When NOT to enable AI tutor

- No signed FERPA addendum with AWS for services in scope
- Cannot implement parental consent API for under-13
- No human review queue for flagged tutor sessions

## Reproduce

1. List every field in LMS schema against table above.
2. Any "Education records" column in Bedrock prompt template → block until de-ID pipeline exists.