LMS-Integrated AI Assessment: How LTI 1.3 Connects Authentic Evaluation to Canvas, Blackboard, and Brightspace

When instructors decide to evaluate student understanding through oral defenses or interactive simulations, they often hit an operational wall. Asking students to orally explain a term paper or navigate a clinical scenario is pedagogically sound. In practice, asking two hundred undergraduates to visit an external website, register a new username, remember another password, and hope their points reach the campus gradebook creates friction that sinks adoption before the term begins.

Instructional designers and academic technologists know this friction well. Isolated tools create duplicate accounts, lost grades, student confusion, and compliance headaches under the Family Educational Rights and Privacy Act (FERPA).

For authentic assessment to work at campus scale, it cannot live on an island. It must integrate directly into the learning management system (LMS) that students and instructors use every day.

That integration relies on Learning Tools Interoperability (LTI), specifically the 1EdTech LTI 1.3 standard and the LTI Advantage suite. Here is how LTI 1.3 operates, why it matters for authentic assessment, and how institutions use it to connect oral evaluations and simulations into Canvas, Blackboard Learn, D2L Brightspace, and Moodle without compromising security or faculty grading authority.

The Operational Failure of Standalone Assessment Tools

Standalone tools frequently look promising in vendor demonstrations but unravel during midterms:

1. Account fragmentation: Students create logins using personal email addresses. These unverified accounts fail to match the official registrar roster, creating orphaned submissions that require manual identification.
2. Disconnected grading: Scores remain trapped in external vendor databases. Instructors spend hours downloading spreadsheets, reformatting student identification numbers, and uploading CSV files into the LMS.
3. Navigation confusion: Instructors paste raw external links into syllabus pages. Students click outdated links, complete incorrect assignment variations, or miss due dates because external deadlines do not populate their LMS calendar.
4. Data security vulnerabilities: Storing student work in external portals without verified institutional single sign-on complicates FERPA compliance and prevents central IT auditing.

When administering an authentic assessment requires hours of spreadsheet maintenance, faculty abandon the format and return to multiple-choice tests. Bringing the assessment into the native LMS course module removes this administrative drag.

What LTI 1.3 Actually Does

The original integration standard, LTI 1.1, was introduced in 2010. It relied on OAuth 1.0a, a shared key-and-secret pair, and basic HTTP POST requests. It passed student identification data in plain request parameters, offered weak cryptographic protection, and lacked native methods to read class rosters or manage individual gradebook line items.

The modern standard, LTI 1.3, replaced that legacy model with security specifications built on OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT).

In an LTI 1.3 architecture, the assessment platform and the LMS never exchange static passwords or shared secrets. Instead, they establish trust using asymmetric public key cryptography:

1. OIDC Initiation: When a student clicks an assignment link, the LMS sends an authentication request to the external tool.
2. Cryptographic Redirection: The tool redirects the user browser to the LMS authorization endpoint, requesting an OpenID token with signed cryptographic state parameters.
3. Signed JSON Web Token: The LMS verifies the active user session, signs a JSON Web Token containing the user encrypted identity and course role using its private key, and transmits it to the tool.
4. Public Key Verification: The tool retrieves institutional public keys from the LMS JSON Web Key Set (JWKS) endpoint, validates the token signature, and grants immediate access.

The entire exchange executes in milliseconds. Students select a module item in their LMS and enter their assigned defense or simulation without a secondary login screen or separate password.

The Three LTI Advantage Services for Authentic Assessment

While LTI 1.3 provides the secure authentication envelope, authentic assessment requires deeper administrative coordination. An oral exam platform needs to identify enrolled students before exams start, allow instructors to place specific scenarios into weekly modules, and return completed rubric marks to the institutional gradebook.

Those functions come from the three core services that form LTI Advantage:

1. Deep Linking 2.0 (Content Selection)

Without Deep Linking, an instructor must copy an external launch URL and paste it into the LMS assignment settings. For multiple course sections, this manual step invites configuration errors.

Deep Linking 2.0 embeds the tool directly into the LMS assignment workflow. When an instructor creates an assignment in Canvas and selects External Tool, Canvas opens an embedded picker. The instructor selects a specific paper defense, clinical scenario, or reading assessment, and clicks confirm.

The platform returns a signed Deep Linking response containing the launch URL, title, points, and configuration data. The LMS automatically populates its assignment settings, placing the defense directly into the course module.

2. Names and Role Provisioning Services (NRPS)

Under legacy LTI, an external tool only learned that a student existed after that student clicked the assignment link. If half the class had not yet attempted the assignment, the external dashboard showed only students who had already logged in. Instructors could not distinguish between students who were preparing and students who were missing deadlines.

Names and Role Provisioning Services (NRPS) solves this through automated roster synchronization. Through secure server-to-server API calls, Rocketproof queries the LMS for the official course enrollment.

This delivers three operational advantages:

• Complete roster visibility: The instructor dashboard reflects the full enrolled cohort from day one, separating completed defenses, in-progress attempts, and unstarted students.
• Role resolution: The system maps LMS roles to application permissions. Enrolled students enter the defense interface; teaching assistants receive grading permissions; instructors of record retain full authoring and grade release authority.
• Proactive accommodations: Instructors can configure extended preparation times, modified turn counts, or alternative text response engines for documented student accommodations before students launch the activity.

3. Assignment and Grade Services (AGS)

Assignment and Grade Services (AGS) manages the bidirectional exchange of evaluation data. AGS enables external tools to create gradebook columns, read existing scores, and transmit completed marks back to the LMS gradebook.

In automated quiz software, AGS acts as an immediate trigger: a student finishes the quiz, the tool tallies points, and the score posts to the gradebook automatically.

In authentic assessment, automated score passback without human oversight is unacceptable. Authentic oral exams, capstone presentations, and clinical simulations evaluate qualitative reasoning that requires faculty judgment.

Faculty Sovereignty and the Grade Passback Boundary

A common fear among faculty discussing AI in assessment is the loss of grading authority. Instructors do not want an algorithm scoring a student verbal defense and posting that score directly to the university registrar.

The evaluation architecture must protect instructor oversight. In Rocketproof, the LTI 1.3 Assignment and Grade Services endpoint sits behind a mandatory instructor review gate:

1. Student completes the defense: The student records their spoken answers or completes their scenario interaction through the LMS launch link.
2. Evidence compilation: The platform transcribes the audio, maps timestamps to specific questions, extracts textual citations from the student submitted artifact, and drafts preliminary rubric recommendations.
3. Instructor review and calibration: The instructor opens the evaluation console. They review the audio recording, read the timestamped transcript, evaluate student reasoning against rubric criteria, and adjust any points or comments.
4. Deliberate grade release: The final grade remains in draft status until the instructor explicitly clicks "Release Grades." Only upon that manual action does Rocketproof execute the LTI 1.3 AGS API call, transmitting the verified score and summary comments directly into the LMS gradebook.

Ungraded rehearsal attempts remain isolated from AGS. Practice scores never overwrite the official gradebook column, giving students a private space to test their reasoning before completing their graded attempt.

To learn more about evidence extraction, see our detailed guide on source-grounded questioning for student submissions and our overview of the Rocketproof oral defense platform.

Platform Implementations: Canvas, Blackboard, Brightspace, and Moodle

Although LTI 1.3 is an open specification maintained by 1EdTech, each learning management system handles configuration differently:

• Canvas by Instructure: Tool registrations occur through Developer Keys managed at the account level. Canvas limits each developer key to a single navigation placement. Rocketproof uses a Dual Developer Key architecture: Key 1 powers assignments, deep linking, roster sync, and grade passback; Key 2 powers a dedicated Course Assistant navigation item that opens a grounded course guide.
• Blackboard Learn: Blackboard conforms to standard LTI 1.3 Advantage specifications while requiring a Deployment ID. Rocketproof stores this Deployment ID during registration, ensuring that requests from multi-campus environments route to the correct department tenant.
• D2L Brightspace and Moodle: Both platforms support standard LTI 1.3 Advantage registrations. Administrators configure external learning tools, map institutional role definitions, and deploy launch links across course units.

For an up-to-date breakdown of current verification statuses across platforms, visit our LMS integration overview.

FERPA, Data Governance, and Security

Connecting external assessment tools to campus infrastructure requires adherence to federal privacy laws and university security policies:

• Asymmetric Cryptography: LTI 1.3 eliminates shared consumer secrets. The external tool signs messages using its private key, and the university LMS validates them using the tool public key endpoint. No shared passwords travel across the network.
• Protection of Student Records: Under FERPA, student educational records must remain protected from unauthorized disclosure. In an LTI 1.3 launch, the LMS can share opaque identifiers. Student submissions and spoken recordings are processed solely to facilitate course assessment and are never used to train external foundational AI models.
• Bring-Your-Own-Key Routing: For universities with strict data governance mandates, Rocketproof supports Bring-Your-Own-Key (BYOK) API routing. Institutions can route inference requests through their own enterprise cloud agreements, guaranteeing that student data never leaves the institutional security perimeter.

To review our institutional security documentation and HECVAT package details, visit our security and compliance center.

Frequently Asked Questions

Can instructors use Rocketproof if their campus does not have an LMS integration?

Yes. Rocketproof functions as a standalone web application whenever an LMS integration is not yet configured. Instructors can create assignments directly in the platform and distribute secure invite links. Setting up LTI 1.3 eliminates separate account creation and automates grade passback, making it the recommended approach for departmental deployments.

What happens when a student drops or adds a course during the semester?

Because Rocketproof utilizes Names and Role Provisioning Services (NRPS), course rosters synchronize automatically. When a student adds the course in the LMS, they appear on the Rocketproof roster upon the next sync cycle. When a student drops, the platform updates their enrollment status while safely preserving completed submission records and evaluation logs for institutional audit compliance.

Do practice attempts send scores to the LMS gradebook?

No. Rocketproof distinguishes between formative practice simulations and graded evaluative assessments. Instructors can configure assignments so that students complete required practice sessions before attempting their graded oral defense. Practice sessions generate immediate feedback for the student but never transmit scores through AGS, ensuring that low-stakes exploratory learning does not alter the student official academic record.

How does LTI 1.3 handle students with approved accessibility accommodations?

In Rocketproof, instructors can configure accommodation profiles directly on course rosters. If a student requires extended preparation time, alternative text response engines, or modified turn counts, those parameters apply automatically whenever the student launches the assignment through the LMS. To explore our broader accessibility architecture and WCAG compliance, read our guide on accessibility in oral assessment.

Practical Assessment Without Administrative Overhead

Authentic assessment does not need to create administrative exhaustion. In the age of generative AI, evaluating student understanding through spoken explanation, clinical simulation, and structured defense gives faculty evidence of real learning that static written submissions can no longer guarantee.

By grounding those assessments in the open LTI 1.3 Advantage standard, institutions remove the technical barriers that once kept innovative pedagogy confined to isolated experiments. Students launch assignments directly from their weekly course modules. Instructors maintain complete sovereignty over rubric scoring and grade release. Gradebook synchronization happens reliably without spreadsheets or manual data entry.

To explore how your department can deploy LTI-integrated authentic assessments, explore our authentic assessment platform, review our interactive AI simulations, or schedule an institutional pilot consultation.