Openness in education was never really about standards and code. It was about keeping institutions and edtech providers in control of their own tools and their own domains, while enabling innovation through radical transparency.
Ask 100 people in edtech what "openness" means and you'll likely hear roughly the same answer. That answer carried the edtech industry for over 20 years. But that same answer has been quietly going out of date.
In practice, openness meant four things:
- Access to source code, so an institution could see how a system worked and change it.
- Alignment to shared standards, so tools could connect without custom work every time.
- Clarity about where and how integrations happen, so individual institutional learning ecosystems could transparently align to outcomes.
- And no black boxes around institutional data, so nothing an institution needed sat out of reach behind someone else's paywall.
That definition has served education very well. It's the reason a district can assemble a tech ecosystem that fits its own students instead of accepting whatever one vendor decided to build. It's the reason a university could build on top of and around a set of core learning tools to deliver a unique student and educator experience. It's the reason "not invented here" stopped being a viable posture for anyone in edtech. None of it was wrong. It's just no longer sufficient.
Two converging forces
Two major change-making forces have converged in edtech, leaving us with the need to evolve our understanding of openness.
The first is that the relative pace of development and change in edtech is shifting quickly. AI has changed how fast anyone can build and how quickly anyone can get at information within systems. This cuts both ways. A small team can now stand up a meaningful integration in an afternoon. At the same time, so can someone probing your system for a weakness.
The second is the introduction of agentic-based capabilities and tools. Agentic AI has essentially changed who, or what, shows up as a user. Protocols like MCP don't just launch a tool inside another tool. They move data and describe systems to software that reasons about them. When the client is an agent instead of a person, our old assumptions about who's on the other end of an integration or an API are no longer useful.
When these two forces meet, being able to look inside a system stops being enough. Institutions need to know who and what is acting in their systems, on whose behalf, and with what access. Openness has to become something organizations practice together every day, not a property of the code.
The goal hasn’t changed, so the old practices still matter. Keeping control now takes new ones. I propose five principles as the foundation for a new era of openness.
Principle #1: Expansive data interoperability
The standards work around data interoperability in education has been extraordinary, and it is still a work in progress in many ways. We need to continue building shared approaches to user access, enrollment, and embedding tools inside one another. We now also need them to orchestrate how data moves between systems as AI and other new technologies enter the picture, which is a harder problem with potentially higher stakes.
Two things stretch this further. First, the set of companies in scope has grown. Plenty of technology companies that weren't born in education now serve education, and interoperability that only reaches other edtech vendors leaves institutions stranded at the boundary.
Second, we have to answer a question we've never had to ask: who counts as a user? An agent acting for a student needs a defined identity, a defined scope, and a defined learner journey. Treating it as an unlabeled human request is how institutions lose visibility into their own systems.
Principle #2: Security and privacy by default
This is the uncomfortable part for many of us with a long history in open source and community-driven innovation. The times have changed.
Publishing how a system works has always carried some risk. What's changed is the speed on the other side. A weakness that would have taken an attacker months or years to find, if at all, can now surface in minutes. Open source code today requires an unprecedented level of proactive community stewardship to minimize collective exposure.
So the obligation attached to openness has grown. Whatever we put out into the world has to be tested and monitored against tools that can move faster than any human reviewer. That's not an argument for closing up. It's an argument for maturing our security practices and raising our collective bar.
Principle #3: Rules for systems moving through systems
We've spent years designing for people moving through software. We now have to design for software moving through software: agents talking to agents, agents acting on behalf of a person, agents doing work while the person who set the goal is nowhere near the screen.
When agent-to-agent interaction is part of the jobs to be done, the security principles we already know still apply: consent, least-privileged access, token scoping, and audit trails that record what acted, not just who logged in. Keeping a human in real authority sometimes costs a little speed, and maximum speed shouldn't be the goal of an educational AI system. Human intervention at the appropriate place should be.
Familiar security discipline and human authority point in the same direction here, and together they create the need for a more nuanced openness. If we can't describe how delegated authority works, we haven't built an open system. We've built an unaccountable one that will fail as systems mature faster than it does. We can still move faster without sacrificing the humanness of our ecosystems.
Principle #4: Transparency about AI use and outcomes
Transparency used to mean telling institutions where their integrations lived and, to a certain degree, how they worked. It has to mean more now.
It means being clear and upfront about what AI is doing inside a product, where it touches a learner's work, and where an educator makes the final call. If AI shapes a grade, the student should know, and the student should be able to question it.
It also means transparency about outcomes. Openness about evidence is the part our industry often skips. Claiming a tool works isn't the same as showing what it changed, for whom, and under what conditions. Evidence matters, and edtech must be transparent about how and why technology does or does not directly impact institutional outcomes.
Principle #5: Translation as the new domain
The last piece is the one I'm most optimistic about.
A lot of the friction in education technology is translation friction. Different standards frameworks, different skill taxonomies, and different names for the same competency all exist within a single institutional ecosystem. Crosswalking that data used to be slow, manual, and expensive. AI makes it tractable, and protocols like MCP and knowledge graphs give the results somewhere to go, and education-aware reasoning models give it something to do.
But translation only works if something stays authoritative. A student information system is the source of truth for enrollment. A transcript is the source of truth for what a learner earned. Mapping between systems is useful precisely because the underlying records hold their meaning. Modern openness means removing friction from translation while being disciplined about which system owns which truth.
What's next
The five principles above aren't a checklist for vendors alone. Institutions set the context and are active collaborators in shaping where openness goes next. What an institution asks for in procurement, what it requires in a data governance conversation, and what it refuses to accept in an AI feature all shape what gets built and the transparency we have all grown to count on.
The goal hasn't changed at all. Institutions and edtech providers still need to control their own tools and their own domains. The work required to honor that has changed.
