01 Set up
Start with your
school’s iPads.
Your IT team installs Tenet and connects it to your school’s settings.
Students sign in with their school account and use approved AI websites in Safari. Tenet works as a Safari extension, also called a plug-in, to apply your school’s supported rules.
Tenet covers supported Safari websites. Other browsers and native AI apps need separate school controls.
Install Tenet
Connect the school’s settings.
Sign in
Use the school account.
Open approved AI
Tenet applies school rules.
More information · 01How to get Tenet onto an iPadApp Store installation, Safari setup, and school rostering
The planned school rollout uses the Tenet Safari app from the App Store. Your IT team can install it centrally through Apple School Manager and device management, or provide the approved listing for individual installation.
Install Tenet and turn it on
- Check your school’s installation route. IT confirms the approved Tenet app and supported iPad setup. On managed iPads, the app may already be installed or available in your school’s app catalog.
- Install the Tenet Safari app. If your school permits individual installation, open the App Store listing supplied by IT, select Get, and complete the installation. For managed installation, follow IT’s app-catalog instructions. Use Update when an update is available.
- Open Tenet and enable it in Safari. Follow the app’s setup guidance. On current iPadOS, go to Settings → Apps → Safari → Extensions → Tenet and turn on Allow Extension. Your IT team may manage this setting for you.
- Allow the approved websites. Grant Tenet access to the AI websites your school uses. Check the Safari profile used for schoolwork, and reload any AI tabs that were already open.
- Sign in and check the connection. Open Tenet from Safari, sign in with your school account, and confirm the expected school and role.
- Try one approved AI website. Check an allowed interaction and a school policy boundary with IT. Then close and reopen Safari to confirm sign-in, rules, and reporting recover as expected.
For school-managed iPads
IT acquires the approved app through Apple School Manager → Apps and Books, syncs it with the school’s device-management system, and assigns it to the intended iPads. IT then connects school settings and enables the extension with the required website access. The Tenet team helps check these on a small group before the school expands.
IT requirement: Apple’s managed Safari extension controls use supervised iPads on iPadOS 18+. Tenet’s current managed-settings route needs iPadOS 18.4+ and configuration targeted at the extension. Confirm the MDM’s support with Tenet; app-only configuration does not reach the extension.
You’re ready when: Tenet is enabled, the student is signed in, and an approved Safari AI site follows the expected school rules.
Instructions: Safari extensions on the App Store · Safari extensions on iPad · School-managed app distribution
Rostering partners
Connect your school’s roster.
Tenet supports school rostering through our partnerships with ClassLink and Clever.
roster
or
Tenet rosters& classes
Your IT team approves the connection and what is shared. The Tenet team helps connect it and verify students, teachers, and class assignments.
School-year setup
Ready for the new year.
The Tenet team helps IT refresh rosters, check class assignments, and review school settings.
- Refresh the roster
- Confirm classes & roles
- Review school & class rules
02 Choose the browser
Students use AI
in Safari.
Your school can allow AI in Safari with Tenet and block selected AI sites in managed Chrome.
IT uses supported Chrome settings in Google Admin for those restrictions. The school can also restrict unapproved browsers and native AI apps through its device controls.
Chrome rules must be configured and tested on school iPads. Keep Safari access open for the approved Tenet experience.
Safari + Tenet
The school’s approved AI path
Managed Chrome
AI sites blocked in managed Chrome
when school policy is applied
More information · 02Block AI sites in Google AdminA practical guide for your student Chrome policy
Apply these rules to the student group that should use Safari with Tenet. Keep teachers in a separate policy group when they need approved AI access in Chrome with Tenet.
For Google’s signed-in user-policy route, IT enables Chrome management for signed-in users and Chrome on iOS → Apply supported user settings to Chrome on iOS. This route depends on school-account sign-in. A school may instead use supported browser enrollment through its MDM and Chrome Enterprise Core.
- Open Google Admin. Sign in at admin.google.com with an administrator account.
- Find the browser settings. Go to Devices → Chrome → Settings → User & browser settings. In Chrome Enterprise Core, the route may appear as Chrome browser → Settings.
- Select the student test group. Choose the intended organizational unit or configuration group. Review inherited rules and any group overrides before changing them.
- Open Content → URL Blocking. Add the school’s selected AI domains under Blocked URLs, one per line. Preserve existing restrictions and review Blocked URL exceptions.
- Save, then refresh the test browser. Restart Chrome on the iPad. Policies usually arrive within minutes, but Google says changes can take up to 24 hours.
- Verify the policy and both browsers. In Chrome, open
chrome://policy, reload policies and checkURLBlocklist. Test the selected sites in Chrome, then confirm approved Safari access still works with Tenet.
Example AI domains
Choose the sites your school intends to restrict. This is a starting list, not a complete inventory of AI services.
chatgpt.com chat.openai.com claude.ai gemini.google.com copilot.microsoft.com
A plain hostname also matches its subdomains. Keep entries specific: blocking google.com would affect more than Gemini. Maintain the list as services and domain names change.
You’re ready when: the student’s managed Chrome blocks the chosen sites, approved Safari use works, and the teacher group retains its intended access.
Google guidance: URL blocking · URL filter syntax · Chrome on iOS policies · iOS browser enrollment · Policy scope and timing
03 Set class rules
Teachers manage class
settings from a laptop.
Open Tenet in the browser. Choose a class. Save the permitted settings.
Teachers use their school account and the school-approved Tenet extension. Class rules stay within district permissions and synchronize to connected, signed-in student iPads.
Teachers do not need to set up each iPad individually.
PII protection for teachers, too.
When your school enables staff privacy controls, Tenet checks supported AI prompts and file uploads for personal information and applies the configured warning, redaction, or blocking policy.
More information · 03Set up a teacher’s laptopChrome, Safari on Mac, class rules, and PII protection
Teachers can use Chrome on Windows or Mac, or Safari on Mac, with the school-approved Tenet extension. Their browser does not have to match the students’ Safari browser.
Chrome on a laptop
For the teacher: open the managed school Chrome profile. If Tenet is already installed, open it from the Extensions menu and sign in. If it is missing, ask IT for the school’s approved install route.
- IT selects the teacher organizational unit in Devices → Chrome → Apps & extensions → Users & browsers.
- Add the school-approved Tenet extension. For the self-hosted channel, use Add Chrome app or extension by ID, select a custom URL, and enter the Tenet-assigned extension ID and update feed.
- Set Installation policy → Force install, then save. Windows and Mac Chrome must be managed for the policy to apply.
- Restart Chrome, open Tenet, and sign in with the authorized school teacher account.
Tenet supplies the matching extension ID and updates.xml feed. Use the school’s assigned channel; do not mix the Chrome Web Store and self-hosted IDs or substitute a versioned .crx file. Desktop Chrome extension instructions do not apply to Chrome on iPad.
Safari on a Mac laptop
For the teacher: the planned rollout uses the Tenet Safari app from the Mac App Store or your school’s managed app catalog.
- Open the approved App Store listing supplied by IT and install or update the Tenet Safari app. If IT manages installation, use the school’s app catalog or the copy already installed on your laptop.
- Open Safari → Settings → Extensions and select the checkbox beside Tenet.
- Select Tenet, choose Edit Websites, and allow the school-approved AI websites. Check the Safari profile used for schoolwork.
- Reload open AI tabs, open Tenet, and sign in with the authorized school teacher account.
School management may control enablement and website permissions. Safari is the Mac option; use the school-approved Chrome extension on Windows.
Set the class rules
- Check your account. Open the Tenet dashboard and confirm your school, teacher role, and assigned classes. If a class is missing, ask your school administrator to check the roster and access.
- Choose the class. Adjust the platforms, class guidance, and other controls your district permits you to change.
- Save and check one student iPad. Connected, authenticated student devices receive the policy through Tenet. Test the intended behavior before using it with the whole class.
How teacher PII protection works
PII means personally identifiable information. With staff DLP enabled, Tenet can check for information such as email addresses, phone numbers, Social Security numbers, and student identifiers in supported AI prompts and uploads.
Your district chooses the response: review a redacted version, automatically redact detected information, or block the send. Some school policies allow an explained override; a hard block cannot be overridden. Use a synthetic test example with IT to confirm the configured experience.
Protection applies inside the enabled Tenet browser extension and supported AI flows. It does not scan every file or application on the laptop. Privacy controls alone do not grant access to class-management tools; those need the authorized teacher account and class membership.
You’re ready when: the teacher can see their classes, a saved rule reaches a test iPad, and the school’s teacher privacy policy behaves as intended.
Installation help: Google extension deployment · Force-install extensions · Safari extension setup
04 Keep school reports
Send reports to your
school’s storage.
BYOS means Bring Your Own Storage.
Tenet sends the usage and incident data your school enables to its configured cloud storage. Your school controls access, retention, and deletion there.
Reporting needs a working connection and an active school sign-in.
More information · 04Connect your school’s storageChoose a provider and get setup help from Tenet
Your school owns the reporting destination. The Tenet team can work with your IT team to choose the storage option, connect it, and verify that the expected records arrive.
Set it up together
- Choose the school-owned destination. Tell us which cloud platform your IT team already uses, who administers it, and which reporting requirements you have.
- Create a private bucket or container. IT chooses the region, access permissions, retention, and deletion rules. Keep permission to write reports separate from permission to read them.
- Connect the school’s Tenet configuration. An authorized administrator opens Analytics, Alerts & Data Connections in the Tenet admin dashboard. Select the S3/GCS or Azure Blob setup path and use the provider-specific instructions with Tenet’s help.
- Configure reporting and reader access. IT delivers the reporting writer settings through the school’s management configuration. Select the intended analytics backend and save the sync settings. Dashboard read credentials are separate; entering them alone does not enable device reporting.
- Agree what gets reported. Review usage and incident settings, authorized staff access, and whether the district wants optional redacted prompt excerpts. Records can include student and class identifiers.
- Test the connection and a real delivery. Run Test Connection, generate approved synthetic test activity from a signed-in test device, and confirm both that a record arrives and that authorized staff can read it.
We can help with the setup.
Bring your IT contact, preferred cloud provider, device-management platform, and reporting requirements. The Tenet team can walk through configuration, troubleshoot the connection, and verify the setup with you. Your school keeps control of its cloud account and data access.
BYOS is the configured reporting destination. Tenet’s authentication, policy delivery, and alert services remain separate. Live reporting requires the correct configuration, connectivity, and an active authenticated session.
You’re ready when: a test record reaches the intended private destination, the right staff can read it, and the school has agreed its retention and access settings.
Before the school rollout
Start with a small group.
Check the whole path.
The Tenet team and your IT team confirm the school’s setup before expanding.
- Tenet is installed, enabled, and signed in on the iPad.
- Approved AI sites follow school rules in Safari.
- Chrome and other app restrictions work as intended.
- A teacher’s saved rule reaches a student iPad.
- Expected reports arrive in the school’s storage.
- Sign-in, rules, and reporting recover after a restart.
Technical details for ITDevice and data diagram, responsibilities, and deployment settings
Device, services, and data
Where Tenet works.
Tenet runs in the browser on the device. Its servers connect school accounts, rosters, classes, and rules. Your school chooses where configured reports are stored.
01 On the device
Student iPad
The Safari extension applies school rules on supported AI websites.
Teacher laptop
Tenet in Chrome, or Safari on Mac, provides class controls and school-enabled PII protection.
Other browsers and native apps are managed separately by school IT.
school settingsTeachers save rules.
Devices receive them.
02 On Tenet’s servers
School coordination
One connected school setup.
School accounts & roles
Authorized sign-in for students and staff.
Rosters & class membership
Students, teachers, and their class assignments.
School & class rules
District settings and permitted teacher changes.
School roster information connects each signed-in person to the appropriate school and classes.
03 · In your school’s cloud
Your reporting storage
Amazon S3 · Google Cloud Storage · Azure Blob Storage
Your school controls
access, retention, and deletion.
This shows the school deployment with rostering. Reporting delivery depends on the school’s configuration; Tenet’s account, roster, policy, and alert services remain separate from the school’s reporting storage.
Apple deployment
The planned production path uses App Store distribution, with Apple School Manager and MDM for school-managed installation. Confirm the app’s availability, supported device versions, supervision, and device-management platform with the Tenet team before deployment.
Apple’s managed Safari extension controls support always-on enablement and website permissions on supervised iPadOS 18 or later. The current Tenet managed-configuration path separately uses ExtensionConfigs on iPadOS 18.4 or later. Configuration must reach the extension; classic app configuration sent only to the containing app is insufficient. Confirm both enablement and configuration delivery in your MDM. Apple extension management · Managed app configuration
Chrome restrictions
In Google Admin, use Devices → Chrome → Settings → Users & browsers → Content → URL Blocking for the selected school group or organizational unit. Examples include chatgpt.com, claude.ai, gemini.google.com, and copilot.microsoft.com. This is an illustrative list; maintain it for your school. Google URL blocking
Chrome on iPad supports applicable signed-in user policies through Chrome Enterprise Core when Chrome on iOS policy application is enabled. Check each setting’s iOS support. Where supported, MDM enrollment using CloudManagementEnrollmentToken provides browser enrollment without relying only on user sign-in. Test the school’s actual managed iPad, including signed-out behavior. User policies · Chrome on iOS enrollment
Teacher access and school data
Teachers use the extension’s dashboard with authorized school accounts. Their laptop browser does not have to match the student’s Safari browser. Class edits remain within district permissions.
Configured BYOS records may contain student and class identifiers. Redacted prompt excerpts require district opt-in. Authentication, policy delivery, and alert services remain separate from BYOS reporting storage.
Sign-in and restart checks
Safari attempts silent Google re-verification when the Google session is available. If recovery fails, an eligible student may retain cached protection, but live reporting and current policy updates require an active authenticated connection. Test Safari closure, device restart, touch input, keyboard input, and each required AI site with the initial deployment group.
Guide updated November 6, 2026