# AI Agents Inside the Trusted Research Environment: Sandboxed Code Execution on NIH, CUI and DUA-Governed Data

> Higher Education · ibl.ai
> Source: https://ibl.ai/courses/higher-education/ai-agents-trusted-research-environment
> Last updated: 2026-11-14

*Sandboxed Code Execution on NIH, CUI and DUA-Governed Data*

**A higher education course from ibl.ai (self-paced, 12 to 14 hours, free).** AI agents inside a trusted research environment: NIH 800-171 attestation, generative AI notice, CMMC status, SATRE controls and sandboxed code on data.

- **Price:** Free
- **Format:** Self-paced, online
- **Time:** 12 to 14 hours
- **Pace:** 3 hours per week
- **Level:** Intermediate
- **Language:** English
- **Subject:** Research

[Enroll](https://lms.ibl.ai/platform/highereducation/courses/course-v1:highereducation+ai-agents-trusted-research-environment+self-paced)

## Course description

A trusted research environment is the only place an AI agent can legitimately work on NIH controlled-access data, CUI or data held under a restrictive use agreement, and this course shows research IT how to put one there. NIH now says that sharing controlled-access data with public generative AI tools through prompts violates the non-transferability terms of the Data Use Certification, and since 2026-02-25 its security standards, built on NIST SP 800-171, reach users of every NIH controlled-access repository. The compliant pattern is not a chatbot with a copy of the data but an agent that writes and runs code inside the enclave, with an egress allowlist, credential injection, output disclosure control and an audit log. You will learn the rules (NIH notices, 800-171 Rev 2 and Rev 3, CMMC status, DUA terms), the threat model for agents on shared HPC (the hijacked authorized agent), the SATRE control framework, and how two campus architectures decide which data classes they may touch. You will finish with a reference design, a DUA-to-control crosswalk and an evidence package for the signing official.

### About this course

A trusted research environment is the only place an AI agent can legitimately work on NIH controlled-access data, CUI or data held under a restrictive use agreement, and this course shows research IT how to put one there. NIH now says that sharing controlled-access data with public generative AI tools through prompts violates the non-transferability terms of the Data Use Certification, and since 2026-02-25 its security standards, built on NIST SP 800-171, reach users of every NIH controlled-access repository. The compliant pattern is not a chatbot with a copy of the data but an agent that writes and runs code inside the enclave, with an egress allowlist, credential injection, output disclosure control and an audit log. You will learn the rules (NIH notices, 800-171 Rev 2 and Rev 3, CMMC status, DUA terms), the threat model for agents on shared HPC (the hijacked authorized agent), the SATRE control framework, and how two campus architectures decide which data classes they may touch. You will finish with a reference design, a DUA-to-control crosswalk and an evidence package for the signing official.

### What you will be able to do

- Distinguish a trusted research environment from a general AI sandbox using SATRE's pillars and capabilities, and state which of the five pillars a given campus service satisfies.
- Cite the NIH requirements that apply to a controlled-access dataset on a given date: the 800-171 attestation (NOT-OD-24-157, effective 2025-01-25), its extension to all controlled-access repositories (2026-02-25), the generative AI notice (NOT-OD-25-081) and the country-of-concern access block (NOT-OD-25-083).
- State the difference between SP 800-171 Rev 2 (110 requirements) and Rev 3 (97 requirements), and explain why Rev 2 remains the DoD and CMMC baseline while Phase II assessments are suspended.
- Trace a prompt-injection path from a shared file or job log on an HPC cluster to an unauthorized action by an authorized agent, and name the control that breaks it.
- Design an agent-in-the-enclave architecture (model placement, data placement, egress, credentials, output checking, logging) and map each element to a SATRE capability and an 800-171 family.
- Translate the terms of a data use agreement into technical controls and an evidence package that an institutional signing official can attest to.

### Who this course is for

**Roles:** research computing and HPC directors, research IT and enclave administrators, CISOs and security analysts who sign NIH and DoD attestations, research data stewards and data governance officers, sponsored programs and export control staff who negotiate data use agreements, and principal investigators who hold controlled-access, CUI or industry-licensed data.

**Institutions:** research universities and academic medical centers with NIH controlled-access data (dbGaP and other repositories), institutions with Department of War contracts that carry CUI, and any institution that signs data use agreements with restrictions on where data may be processed.

**Before you start:** familiarity with your institution's data classification levels and with a Linux or HPC environment (a scheduler, shared storage, project accounts). No security certification is required; the NIST and SATRE controls are introduced in the course.

### Format

- Estimated time: 12 to 14 hours.
- Level: intermediate to advanced. Assumes the learner runs or secures research systems; no prior AI agent work is assumed.
- Hands-on: two labs and a traced injection exercise on a synthetic dataset supplied with the course that imitates a controlled-access genomic study (a de-identified phenotype table, a sample manifest, a consent-group file and a fake Data Use Certification with three restrictions). Learners run an analysis agent inside a sandbox with egress blocked, observe its exfiltration attempts refused, gate the agent's outputs through a disclosure check, and read the resulting audit log. The labs run on a hosted sandboxed agent supplied by ibl.ai (see https://ibl.ai/resources/capabilities/sandboxed-agent-execution); the pattern transfers to any enclave that can execute code with an egress allowlist and an audit log.
- Structure: 4 sections, each ending in an AI conversation assessment, then a capstone assessment.

Self-paced. Every lesson is taught by an AI tutor that opens with a short story and works through one idea and one question at a time. Each section ends with an AI conversation assessment, and the course closes with a capstone assessment. Section assessments count for 60% and the capstone for 40%; 70% passes. There are no multiple-choice quizzes.

### Currency of this course

Last verified 2026-09-28. The rules in this course are moving. NIH's NIST SP 800-171 attestation requirement has applied to Genomic Data Sharing policy data since 2025-01-25 and, per NIH's requirements page updated 2026-09-25, to users of all NIH controlled-access repositories for new or renewed agreements since 2026-02-25. NIH's generative AI notice NOT-OD-25-081 (2025-03-28) says further guidance is coming. The Department of War suspended CMMC Phase II third-party assessments by memos dated 2026-07-13; Phase I self-assessments, DFARS 252.204-7012 and the 110 controls of SP 800-171 Rev 2 remain. Section 4.2 carries the status as of this date and is re-verified monthly. Check the NIH notices and the sources in the reading list before quoting a requirement or a date.

## Outline

### Section 0 · Start here

- 0.1 Orientation

### Section 1 · Know what a TRE is and what governs its data

- 1.1 Definitions and the control framework
- 1.2 The rules that govern the data
- 1.3 Section 1 assessment

### Section 2 · Model the threat to agents on shared infrastructure

- 2.1 The hijacked authorized agent
- 2.2 Sandbox engines and isolation
- 2.3 Section 2 assessment

### Section 3 · Design the agent-in-the-enclave pattern

- 3.1 Reference architecture
- 3.2 Output disclosure control and the terms of the agreement
- 3.3 Section 3 assessment

### Section 4 · Produce attestation evidence and watch the policy

- 4.1 Evidence for the signing official
- 4.2 Policy watch (status as of 2026-09-28; re-verified monthly)
- 4.3 Section 4 assessment

### Section 5 · Capstone & wrap-up

- 5.1 Capstone
- 5.2 Capstone assessment
- 5.3 Wrap-up

## Instructors

- ibl.ai Higher Education, Course team (ibl.ai)

## More higher education courses

- [ADA Title II Digital Accessibility for Course Content: The 2027 Deadline](https://ibl.ai/courses/higher-education/ada-title-ii-course-accessibility)
- [AI Academic Advising at Scale: Caseload Triage, Proactive Outreach and Human Handoffs](https://ibl.ai/courses/higher-education/ai-academic-advising-caseload-management)
- [AI for the Accreditation Self-Study: Evidence Inventories, Assurance Arguments and Compliance Certifications](https://ibl.ai/courses/higher-education/ai-accreditation-self-study)
- [AI in Enrollment Management: Yield, Summer Melt and Admit-to-Enroll Outreach](https://ibl.ai/courses/higher-education/ai-enrollment-yield-and-summer-melt)