A planning agent inside Microsoft 365

The problem and opportunity

Northern Ireland's draft AI strategy names lesson planning and feedback support as a public-service application, without saying what a teacher would be given, what it would be built from, or what it must never do.

CCEA publishes the curriculum as a document rather than as data. A teacher checking whether a lesson meets a statutory requirement is reading a PDF, and an agent drawing on it has nothing to cite unless someone extracts it first.

Schools here already have Microsoft 365. A teacher planning a term is already in Word, already in Outlook, already in OneDrive. A separate planning website would be one more place to go and one more password.

Published sources

• The Northern Ireland Curriculum: Primary — Council for the Curriculum, Examinations and Assessment
• 2025/26 Assessment Arrangements — Council for the Curriculum, Examinations and Assessment

The problem statement above derives from the lesson-planning-feedback playbook published at lab-notes.ai. The research is published by its authors; the prototype is ours.

What we built

• A curriculum index of 1,446 statements extracted from CCEA's published primary curriculum: 315 statutory requirements, 960 examples and 171 pieces of guidance, across six areas of learning, each carrying the printed page it came from.
• Statutory means statutory. CCEA distinguishes requirements from illustrations by font weight, so the extractor reads font weight — and a statement may be called statutory only where the source document declares, in its own text, that it marks requirements that way. Exactly one document in the corpus does, on page 56. If CCEA republishes without that declaration, extraction stops rather than relabelling requirements as examples.
• A declarative agent for Microsoft 365 Copilot with a custom action, so the artefacts land where a teacher's materials already live.
• Publishing takes a review rather than a drafted week, so handing the publish path a plain plan is a compile error. The type does not carry approval, so the publish path re-checks that every lesson has been decided and throws before any request reaches Microsoft.
• Every outbound request is checked against an allowlist of exactly two Graph paths — the teacher's own calendar and their own OneDrive. Sending mail, reading another user, touching a group, and forwarding a calendar event all fail there rather than in review.
• A safeguarding check that runs first on every inbound message, ahead of the kill switch and the spend cap, and points to the school's own designated teacher.

What it does not do

• No teacher has used it. The strategy names the opportunity; that is a brief, not evidence that anyone wants it built, and this prototype creates none.
• The safeguarding check is a keyword filter, and its blind spot is real. It catches direct statements. “She’s been very quiet since her mum’s new partner moved in” is a disclosure to a person and nothing at all to a regular expression. It is a floor, not a safeguard; the safeguard is the designated teacher it points to.
• The statutory split is verified against sampled pages, not audited across all 315. An earlier build of this index called 456 statements statutory, of which the document’s own headings and footers turned out to be a third. The count moved because someone looked.
• It holds no pupil data of any kind — no name, work, response, attainment, need or characteristic, and no field for one. Feedback here means feedback structures and success criteria, never a judgement about a child.
• It states no saving in planning time. Nothing published measures teacher planning workload, so this measures nothing and claims nothing.
• Neither plugin route verifies the token’s signature — not the drafting route and not the writing one. Both decode it the same way, read the identity claim out of it and trust it for nothing else. On the drafting route that claim keys a per-teacher rate limit, so a forged token could reset someone’s own quota. On the writing route it only decides whether to answer at all: the raw token is passed straight to Microsoft Graph, which validates signature, audience and expiry properly, so a forged one is refused there and nothing is written. A hosted service would validate against the tenant’s signing keys before anything else happened. Neither route does, and that is a gap rather than a simplification.
• It never contacts anyone. Calendar events carry no attendees, because an event with an attendee makes Microsoft send that person an invitation.