Safeguarding
Every bina lesson has a teacher in it, and that teacher is teaching. What an online school does not have is the building around them — the colleague who glances in, the corridor, the second adult who notices the child who has gone quiet. bina is building an additional pair of eyes in software, so a teacher can keep their attention on the lesson. The wider design has two independent lanes: one reads what the class is saying, one checks camera presence. The camera-presence lane has a limited production pilot; the full design shown here is not school-wide coverage. Anything either lane raises enters a timed escalation ladder that ends with named people.
The language lane is built as a prototype, and the camera lane is active in a limited pilot. Formal checks cover specified routing and case-handling properties, not whether a detector recognizes every concern. The camera detector processes frames locally; the language lane is the part of this design that can reach outward, sending attributed text to an approved model endpoint. External processing needs agreed terms and the relevant permissions. The wider supervision prototype remains gated by consent, evaluation and operational readiness. A completed code path is not the same as a classroom rollout. The ambition is to help duty of care grow with the school: give responsible adults another way to notice a concern, a clear route to respond, and a record they can review. Software supports that responsibility; it cannot guarantee a child’s safety.
A lesson, as the system sees it
Almost everything a supervision system sees is an ordinary lesson, and the whole design is shaped around that. The class’s last thirty seconds are screened every five seconds, so a sentence cut at one window’s edge arrives complete in the next. Every student’s camera is sampled continuously and checked on bina’s own processors, without an external model call. The synthetic lesson below runs live in your browser. Put something into it and watch what happens.
Two lanes share one time axis. The upper band is the whole class’s speech, one row per participant, screened in a thirty-second window that steps every five seconds; a window with no speech in it costs nothing. The lower band is one row per student camera, sampled continuously and checked on bina’s own processors, solid while a face is present and dashed while it is absent. Anything either lane raises travels along the alert channel into the escalation ladder.
What safeguarding holds
Two detection lanes, one case record, one escalation ladder, and a set of design properties that are written down and machine-checked.
The text laneBuilt The whole class read together on a rolling window, screened by one small model with a single broad question about danger.
The frame laneLimited pilot Each student’s camera, checked on bina’s own processors for two things only: a face gone from frame, and more faces than expected.
The consent gateBuilt A dedicated supervision consent, held separately from the media consent a family signs for photographs.
The incident machineIn build Each concern is a small state machine: candidate, then confirmed, retracted, or escalated unresolved on a deadline.
Routing rulesBuilt Written policy in code decides who is told, in what order, and how long each rung has before the next one is tagged.
The escalation ladderBuilt One card in the class’s own staff channel, escalations threaded beneath it, and buttons that move the case, so a response is a recorded state change.
The evidence cardBuilt What an alert carries: the category, the class, whether it happened in the main room or a named breakout, and the anchor quote.
The degraded signalBuilt A dead stream, a model outage, an exhausted quota or a failing detector each raise a supervision-degraded alert of their own.
The proof harnessBuilt The routing guarantees exist as formal specifications beside the code, model-checked exhaustively, plus an offline benchmark and a machine simulator.
Three ways a school watches a lesson
A teacher, a recording and a live signal offer different kinds of support. None is a complete safeguarding system on its own. bina’s answer is two independent detectors and a clock on the human response, with the guarantees written down where they can be argued with.
| A room with a teacher in it | Record now, review later | bina: the wider supervision design | |
|---|---|---|---|
| Who notices | The adult present, using professional judgment. | A reviewer, when a recording is selected for review. | Two independent lanes in the design, reading speech and camera presence separately. A failure in one does not make the other a complete substitute. |
| What is covered | An adult’s observation and understanding of the classroom. | The captured view, with coverage depending on the review process. | The whole conversation read together for context, and every student’s own camera read on its own. |
| When someone finds out | During the lesson when a concern is noticed. | When the material is reviewed. | During the lesson. The clock on the human response starts with the alert, and it escalates on its own if nobody answers. |
| What the record is | Observations and the school’s reporting process. | Recorded material that needs relevant context and review. | A structured case: category, severity, class, room, the anchor quote, and every delivery attempt made against it. |
| Who decides to escalate | The responsible adult, following the school’s policy. | An authorized reviewer, following the school’s policy. | Deterministic code, from written policy. A model may propose a category and a severity; it decides nothing about who is told. |
| What a family agrees to | The school’s enrollment and safeguarding arrangements. | A recording clause in the enrollment pack. | A dedicated supervision consent, separate from media consent, where opting out removes the child ahead of any processing at all. |
| When it fails | Missed concerns may only become apparent through follow-up. | Gaps depend on capture checks and the review process. | A dead stream, a failed model call or a degraded detector raises its own alert. Quiet is never counted as calm. |
| The trade | Human observation is essential and benefits from support. | Useful evidence, and a review and response workload to match. | Analyzing every lesson while it is happening has a running cost; filing a recording costs almost nothing. bina is evaluating that cost against the value of earlier signals, response workload and a clear record. |
From a signal to a named adult
Both lanes drop into one channel, pass the consent gate, become a case in the database, and only then reach a person. Every rung of the ladder has a clock on it, and the response properties on the rail below are written down and machine-checked.
Design checks. opt-out: an opted-out student is dropped ahead of any processing, buffering or egress, on both lanes. fails closed: a participant who cannot be resolved to exactly one consenting student is dropped without being analyzed. one alert: a lit alert never re-fires while it stays lit, so a continuous condition costs one alert and one adjudication. nothing lost: deduplication gates delivery and never the record. code decides: the model proposes a category and a severity, and written policy decides who is told and what they may see. never silent: a dead stream, a model outage or a degraded detector raises its own signal.
The commitments that shape it
Building this well is mostly a matter of what the system refuses to do. Four refusals carry most of the weight: no processing before consent, no routing decision by a model, no inference about a child’s emotional state, and no image of a child leaving bina’s own machines.
Consent is checked before anything is looked at
The gate reads a dedicated supervision consent, kept apart from the media consent a family signs for photographs, so one can be withdrawn without touching the other. An opted-out student is dropped ahead of processing, buffering and any network egress on both lanes, and filtered again at the point of writing. The check fails closed, so bina accepts losing a signal in order to avoid analyzing a child it has no permission to analyze.
The model proposes and code decides
A language model returns a category, a person and a proposed severity. Every consequence after that is deterministic: which tier is tagged, how long that tier has, whether the quote may be shown, what a locked phone is allowed to display. This boundary is what makes the system reviewable by a safeguarding lead who does not read code.
Emotional state is out of bounds by design
The question put to the model is about described situations. The design excludes emotion inference; a detector should not turn a facial observation into a judgment about a child’s inner state. A silent child is recorded as a silent child. Camera presence adds a limited observation, not an explanation of their wellbeing.
Images stay on bina’s own machines
Camera frames are checked by an isolated local service with no network access of its own, reachable over a single local socket. An extra person in frame is stored as a count and never as an image or an identity. Only attributed text is ever sent outward, and the terms behind that endpoint (no training on the data, a signed processing agreement, an answered residency question) are a precondition of the lane running at all.
A concern about an adult never routes to that adult
The routing engine partitions by who a concern implicates. Where the implicated party is a member of staff, or where it cannot be established, classroom recipients are withheld by default and the case goes to the safeguarding side of the ladder alone. Who spoke is resolved against the school’s own roster and staff records at the moment of writing, and the detector’s own guess is never trusted for it.
The routing properties are machine-checked
The router and the incident machine exist as formal specifications beside the code. Model checking explored roughly 44.9 million distinct states with zero violations of the router’s seven specified safety properties. That result applies to the model and its assumptions, not to detection accuracy in a real classroom. The exercise found genuine defects along the way: a starvation path where one busy concern could hold another waiting forever, and an expiry rule that allowed repeat alert storms. Each invariant was then re-tested by injecting the bug it exists to catch.
What compounds
A response trail a team can review
A structured case makes the response visible: what was raised, who received it, and how they acted. That record helps a safeguarding team follow through and examine its practice. It complements the judgment and relationships in a classroom; it does not establish that every concern was caught.
The cost curve points the right way
The camera lane spends electricity on machines bina already owns. The language lane asks one small model one short question per window, and a window with no speech in it costs nothing at all. Every improvement in the price and quality of small models lands on this system directly, with no rebuild.
The attribution layer is reusable
Knowing reliably which line of a live lesson belongs to which child is the genuinely hard part, and it is solved, parity-locked across both services that resolve it, and running. The attendance work already builds on the same stream. Whatever else may read it is a separate consent question, and bina treats it as one.
The next step is a carefully governed extension beyond the camera pilot. Consent language, detection evaluation and the safeguarding team’s readiness all matter before broader analysis reaches classrooms. The engineering after that is designed and waiting: merging what the two lanes saw into one case, a wider set of camera conditions behind a calibrated adjudication step, and speech-to-text moved onto bina’s own hardware.