This guide is for schools and districts that want students reaching Flint from a school-controlled environment only, with other large language models blocked during school hours. It is written for IT teams.
The split-access idea in two lines:
- The regular browser profile blocks the AI services your IT team identifies, Flint included.
- A dedicated browser or kiosk configuration aims to allow Flint and its required sign-in and content services while restricting other navigation.
Before you start:
- None of this is required to use Flint. These device restrictions are separate from Flint's own access and moderation settings.
- This is for schools that want an extra layer of access control during school hours.
- It only covers school-managed devices and networks. Flint cannot stop a student using another AI tool on a personal device, a home network, or an unsupervised machine.
- A kiosk or single-app mode does not necessarily restrict websites inside that app. Test navigation, sign-in, content loading and attempts to leave the approved environment on each device type before rollout.
Step-by-step guide
Open each step to see the detail.
- Why: a school-approved launch page gives students a clear starting point.
- How: add a link to your school's normal Flint URL on your school portal or another school-controlled page. A launch link does not host Flint on your domain or prevent students navigating directly to Flint.
- Why: your web filter controls which services students can reach.
- How: use your filter (GoGuardian, Securly, Lightspeed, Cisco Umbrella or similar) to allow Flint's domains and block the well-known AI domains —
chatgpt.com,gemini.google.com,claude.ai,poe.com, and any others your team tracks.
Ask Flint for the current dependencies for your deployment before creating an allowlist. Google or Microsoft sign-in and content/storage services may require access beyond Flint's app domain. Test sign-in, attachments, images and the classroom tools you intend to use; a Flint-domain-only rule is not a complete allowlist.
Why: separate configurations let your IT team restrict AI access in everyday browsing while allowing Flint in the approved environment.
- General profile (blocks identified AI services, including Flint): block ChatGPT, Gemini, Claude, Poe and
flintk12.comfor everyday use, and push your safe-browsing and extension policies. - Approved kiosk configuration: configure navigation and device restrictions supported by your platform, and verify any monitoring integration. Check that the kiosk's exceptions take precedence over the general profile's Flint block.
Device-specific instructions
General profile (block all LLMs, including Flint)
In the Google Admin console:
- Block ChatGPT, Gemini, Claude and Poe
- Also block
flintk12.com - Push safe-browsing and extension-control policies
Kiosk configuration to validate
- Check your managed ChromeOS version's supported kiosk configuration for Flint's normal URL
- Configure website restrictions separately from app confinement
- Apply supported shortcut and tab restrictions, then test attempts to leave the approved environment
- Verify whether your GoGuardian or Lightspeed monitoring setup works in that configuration
Standard user profile
- Block ChatGPT, Gemini, Claude, Poe and
flintk12.com - Push safe-browsing and extension-control policies through Group Policy or Intune
Assigned Access / kiosk mode
- Create a dedicated user account (for example
FlintUser) - Use Assigned Access with Microsoft Edge for a single-app browser kiosk; desktop Chrome needs a different configuration
- Check your Windows edition: Assigned Access supports Pro, Enterprise, Education and IoT Enterprise editions
- Configure browser navigation restrictions separately, including the sign-in and content dependencies above
- Apply supported user-switching, application and shortcut restrictions, and test them on your devices
- If considering Safe Exam Browser, validate Flint compatibility and your assessment requirements before using it; this guide does not establish that compatibility
General profile (block LLMs, including Flint)
- Use Apple School Manager with an MDM such as Jamf or Mosyle
- Block ChatGPT, Gemini, Claude, Poe and Flint
Guided Access (Safari only)
- In Settings → Accessibility → Guided Access, enable the feature and set its passcode
- Open Flint in Safari
- Triple-click the iPad's top or Home button, choose Guided Access if prompted, configure the session options, and tap Start
- Guided Access confines the device to Safari, not to Flint's website. Configure and test a separate MDM or web-filter allowlist to restrict Safari navigation
General profile (block Flint and other LLMs)
Use Apple School Manager with an MDM such as Jamf or Mosyle to:
- Block Flint and the other LLM domains in Safari and Chrome
- Lock the allowed domain list and restrict app installation
- Disable keyboard shortcuts and restrict access to System Settings
Restricted browsing to validate
- Review the web and app restrictions available in System Settings › Screen Time › Content & Privacy, or your managed-device policies
- Include required sign-in and content services in any website allowlist
- Test restrictions across Safari, Chrome and other installed apps; do not assume Screen Time alone creates a browser kiosk
- If using SimpleMDM or Jamf, validate the specific configuration and its limits with the vendor
▶️ Jamf guide to blocking Safari on macOS 13+
The linked guide blocks Safari, not other browsers, and notes that external apps can still open Safari. It is not a complete Flint-only browsing recipe.
- Why: browser policies can reduce ways to work around your filter, but no individual setting proves the environment cannot be bypassed.
- How: review supported Chrome or Edge policies for private browsing, extension installation, SafeSearch and URL access. Include required sign-in and content services, and test the combined policies rather than assuming a Flint-only URL rule is sufficient.
A note on scope
These are general recommendations to help your IT team build a controlled, focused environment and make Flint the approved AI tool on your devices. They are not a verified assessment-lockdown configuration for every platform.
For Flint's own student access limits, see limiting school access hours and restricting Flint usage to school grounds. Those settings do not block other AI services.
⚠️ Flint isn't responsible for third-party software, hardware or services referenced here (web filters, MDMs, external tutorials). Implementing and maintaining these measures is your school or district IT team's responsibility. Test every setting and review your policies regularly to make sure they fit your environment and the regulations that apply to you.