EduOps

EduOps, as this page uses it, is learning operations: the work of running the platforms, integrations, assessments and records through which learners are enrolled, taught, assessed and credentialed. Its output is not “courses delivered” but results that can be trusted: the right people in the right courses, accessible learning, assessments whose scores mean what they claim, grades that reach the gradebook, and certificates that a third party can verify.

In one line: EduOps keeps the evidence chain from enrolment to credential correct, accessible and auditable.

The label is not standardised (what EduOps is not); the practices rest on established foundations: learning management systems (LMS), 1EdTech, ADL and IEEE interoperability standards, professional testing standards and W3C accessibility guidelines.

For LMS administrators, instructional designers, assessment leads, training or academic operations managers, and edtech engineers, in universities, schools, corporate academies and certification bodies. Legal points are flagged by jurisdiction, not settled.

Learning systems fail quietly. A learner in the wrong section studies for weeks unnoticed; a tool sends scores the gradebook rejects; an answer key is wrong and the pass list is published; a timed quiz has no extra-time override for a student with an approved accommodation; a certificate cannot be verified two years later because the issuing course was deleted. None of these is a server outage. Each damages the one thing education sells: trust in the result.

A public example: in August 2020 England’s exam regulator replaced model-calculated AS, A level and GCSE grades with the grades schools had estimated (or the calculated grade, if higher) after admitting that the approach “caused real anguish and damaged public confidence”; the chair’s statement added, “For all of that, we are extremely sorry.”^[4] Most failures are smaller, but the pattern is the same: the cost lands on learners first and on the institution’s credibility second.

• Not a recognised profession or framework. The only explanatory use found is a Linux Handbook piece (updated 2023) that expands EduOps as “Educational Operations” and defines it as “the application of DevOps inspired principles, coupled with effective DocOps and HumanOps strategies” to bring academia and industry closer.^[1] That is a proposal about curricula, not an operating practice with a body of work.
• Not a product category, although products use the name. EduOps is a school ERP for Indian schools^[2] and a Notion consultancy.^[3] EdOps, a US firm founded in 2009, states its mission as “to minimize the financial, operational, and compliance demands of running a school”;^[5] there “education operations” means the school’s back office, which this page does not cover.
• Not the same as “LearnOps”. Cognota writes “LearnOps® is a philosophy and framework for creating efficient Learning Operations” and says the term “was coined by Cognota”.^[6] Practitioner writing on learning operations covers request intake, technology administration, vendors, compliance and analytics for corporate L&D.^[7] This page overlaps with it but adopts no vendor framework.
• Not the L&D programme or HR. Deciding who must be trained, on what budget, and keeping mandatory-training policy belongs to PeopleOps. EduOps delivers and measures the learning. This split is an editorial distinction of this Atlas.

The label has no history; the practices do, and their dates explain today’s constraints.

Mental model: the evidence chain. Every credential rests on seven links: enrolment → access → attempt → score → grade → credential → record. A certificate is only as good as the weakest link. Most EduOps work is making each link correct (right person, right version), accessible (the barrier is not what you are measuring) and auditable (you can show how a result was produced and change it under control).

flowchart LR
  P["PeopleOps: who must learn what"] --> E
  C["ContentOps: content assets"] --> E
  I["IdentityOps: accounts, SSO"] --> E
  V["PrivacyOps: retention, lawful basis"] --> E
  W["WebOps, SysOps: running platform"] --> E
  E["EduOps: enrolment to credential"]
  E --> CO["ComplianceOps: completion records"]
  E --> A["AnalyticsOps: learning measures"]
  E --> R["PeopleOps: results, credentials"]
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class E core
  class P,C,I,V,W,CO,A,R neutral

The boundaries below are editorial distinctions of this Atlas, chosen so that each page teaches one thing.

No EduOps charter exists; this one is this Atlas’s proposal. Mission: every result we issue can be explained, reproduced and defended to the learner, the institution and a third party.

1. Validity first. The 2014 testing Standards define validity as the degree to which evidence and theory support score interpretations for proposed uses: “It is the interpretations of test scores for proposed uses that are evaluated, not the test itself.”^[23] Write down what a pass is meant to show before building the quiz.
2. Fairness is part of validity. In the Standards’ words, “Fairness is a fundamental validity issue”; accommodations exist to remove “construct-irrelevant barriers” (Standard 3.9).^[23]
3. Records are append-only. xAPI makes this explicit: “Statements are immutable”, and voiding “does not destroy a Statement”.^[20] Apply the same rule to grades and credentials: correct by a recorded change, never by silent edits.
4. Standards at the boundary, choice inside. Use open standards where data crosses a system boundary; keep freedom inside.
5. Calendar-aware change. Learning has hard dates (term start, exam windows, grade deadlines). Change freezes follow them.
6. Least data. Share with tools only the learner data the task needs; cmi5 says the LMS “SHOULD create” the launch actor “with an object … that does NOT include sensitive PII”.^[10]

Non-goals: maximising completion rates for their own sake; automating judgement about individual learners without review.

Titles vary by sector (a university’s “learning technologist”, a company’s “LMS administrator”); the roles matter more.

R = responsible, A = accountable, C = consulted, I = informed. Small teams combine roles, but nobody should be the only reviewer of their own items. The data protection lead is consulted, not accountable: in GDPR jurisdictions a data protection officer’s tasks are to advise and to monitor compliance (Article 39),^[24] and Article 38(6) requires that other duties “do not result in a conflict of interests”.^[25] Where a data protection impact assessment is required, make it a gate before the model goes live.

• Day 0, design: analysis of needs (often from PeopleOps or a curriculum committee), blueprint, content, items, accessibility review, integration tests, course readiness sign-off.
• Day 1, run: enrolment sync, access, delivery, support, assessment windows with overrides, monitoring of passback and load.
• Day 2, close and improve: grade release, item analysis, regrade decisions, credential issue, records retention, course review.

ADDIE (analysis, design, development, implementation, evaluation) names the same arc;^[8] SAM (“an iterative process model”) shortens it with prototypes.^[26] Either way, the close phase must feed evidence back into design.

• Change calendar with freezes around term start and exam windows; emergency changes need the assessment lead’s consent.
• Assessment board (or a named assessment lead in small settings) decides cut scores, regrades and item retirement, and records the reasons. Standard 5.21: “When proposed score interpretations involve one or more cut scores, the rationale and procedures used for establishing cut scores should be documented clearly.”^[23]
• Integration review before any tool receives learner data: standard, data shared, owner, exit plan.
• Ceremonies: term-start readiness review, exam-window stand-ups, post-sitting item review, termly course review.
• Escalation: learner-impacting faults (wrong grade, missing accommodation, credential error) go to the assessment lead the same day; platform faults follow the hosting team’s incident process (IncidentOps).

The architecture is a hub (the LMS) with standard-shaped edges. The standard on each edge is the thing to get right; products change, edges last.

flowchart TB
  SIS["System of record: SIS or HRIS"]
  PKG["Content packages"]
  LMS["LMS: courses, gradebook, question bank"]
  TOOL["External tools"]
  LRS["Learning Record Store"]
  CRED["Credential issuer"]
  WH["Analytics warehouse"]
  WAL["Learner wallet"]
  SIS <-->|"OneRoster: rosters, grades"| LMS
  PKG -->|"SCORM or cmi5"| LMS
  LMS <-->|"LTI 1.3 launch, AGS scores"| TOOL
  LMS -->|"xAPI, often plug-in"| LRS
  LMS -->|"issue request"| CRED
  LRS --> WH
  CRED -->|"Open Badges 3.0"| WAL
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class LMS core
  class SIS,TOOL,PKG,LRS,CRED,WAL,WH neutral

Two edges are often not built in: Moodle sends statements to an external LRS only through third-party plug-ins such as logstore xAPI,^[27] and the Open Badges version an LMS issues must be checked per product (no claim is made here for Moodle).

Trust boundaries. Each edge carries personal data. LTI 1.3 tools MUST validate the platform’s token signature, an exact issuer, their client ID in the audience, expiry and the presence of a nonce; rejecting reused nonces is a SHOULD.^[28] Feeds should use service accounts limited to their courses. Vendor support channels are part of the boundary: in the PowerSchool incident of December 2024, one district reported that an intruder with “a compromised credential” used “maintenance access channels” and took records “dating back to 2005”.^[29]

Alternatives. A single vendor suite can replace several edges with proprietary links; it is simpler to run and harder to leave. For an LMS-logs warehouse instead of an LRS, see deep comparisons.

flowchart TB
  A["Enrolment synced and reconciled"] --> B["Access set: groups, dates, overrides"]
  B --> C["Learner attempts assessment"]
  C --> D["Scores recorded, tool scores passed back"]
  D --> E{"Item analysis and checks pass?"}
  E -->|yes| F["Grades released"]
  E -->|no| X["Hold release, assessment lead decides"]
  X --> Y["Fix key or item, dry-run regrade, record decision"]
  Y --> F
  F --> G["Credential issued, verifiable"]
  G --> Q{"Learner queries result?"}
  Q -->|no| H["Record retained, change history kept"]
  Q -->|yes| RQ["Review query; correct grade and credential under a recorded decision"]
  RQ --> H
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  class A,B,C,D,F,G,H core
  class X,Y,RQ risk
  class E,Q decision

Item quality loop. Items are the smallest unit that can make a result wrong, so they get their own cycle. Standard 4.10 asks that the psychometric model be documented and that the sample used to estimate item properties be “of adequate size and diversity”.^[23] With small cohorts, treat statistics as prompts for expert review rather than verdicts.

flowchart TB
  B["Blueprint: what to sample, how much"] --> W["Write items to the blueprint"]
  W --> R["Peer review: key, wording, bias, accessibility"]
  R --> U["First live use"]
  U --> S["Item analysis: facility, discrimination, reliability"]
  S --> D{"Evidence and expert view"}
  D -->|"sound"| K["Keep in bank"]
  D -->|"fixable"| V["Revise: new version"]
  D -->|"faulty or exposed"| T["Retire"]
  V --> R
  K --> U
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  class B,W,R,U,S,K,V core
  class T risk
  class D decision

Interoperability standards (normative specifications; check what your platform actually supports):

Assessment standards (professional, not legal): the open-access Standards for Educational and Psychological Testing (2014) of AERA, APA and NCME.^[23] A practice quiz needs less evidence than a licensing exam; scale evidence to the stakes.

Design and quality frameworks (optional): ADDIE and SAM;^[8][26] the Quality Matters Higher Education Rubric, Seventh Edition, built around “Alignment” of objectives, assessment, materials, activities and technology;^[33] CAST’s UDL Guidelines 3.0 (July 2024).^[34] Evaluation: Kirkpatrick’s four levels (reaction, learning, behaviour, results), with the advice that “it is critical to start with Level 4: Results”.^[35] So design starts from the Level 4 result the programme owner (PeopleOps) or faculty defines; EduOps then measures levels 1 and 2 and supplies data for 3 and 4, which that owner interprets. This split is an editorial distinction of this Atlas.

Vendor-neutral categories first; products are examples verified on 2026-10-23, not recommendations.

Release cadence is a constraint. Moodle’s release table (updated 4 October 2026) gives 4.5 LTS security fixes until 4 October 2027 and 5.3 LTS (released 5 October 2026) until 1 October 2029.^[39] Advisories arrive between releases, for example MSA-26-0044, “Missing access checks on H5P content files” (15 October 2026, Serious).^[40]

Hosted LMS operations differ. On a vendor-hosted LMS the vendor sets the calendar: an Instructure post (2023) described new Canvas features arriving monthly, with a beta environment overwritten from production every Saturday and LTI testing listed as not available there.^[41] The institution cannot freeze releases, so it tests them in beta before exam windows (treating beta as holding real learner data) and checks tool launches in a production test course. This page’s examples use self-hosted Moodle; the duties are the same.

Automation that clearly helps: roster sync with reconciliation, scheduled reminders, automatic overrides from an accommodations list, passback monitoring, item-statistics reports after each sitting, certificate issue on release. Keep a human decision on anything that changes a learner’s result.

• Regulation (EU, not legal advice). The AI Act lists as high-risk AI systems used to determine admission, to “evaluate learning outcomes”, to assess the level of education a person will receive, and “for monitoring and detecting prohibited behaviour of students during tests” (Annex III, point 3).^[42] Its Article 5 bans AI used “to infer emotions of a natural person in the areas of workplace and education institutions”, except for medical or safety reasons, which has applied since 2 February 2025.^[43][44] After the 2026 “AI Omnibus”, the high-risk (Chapter III) requirements for Annex III systems apply from 2 December 2027 instead of 2 August 2026.^[45] Article 6(3) lets a listed system escape the high-risk class if it does not materially influence decisions, for example a narrow procedural or preparatory task, but never when it profiles people.^[46]
• Bias. A review of the field found evidence of algorithmic bias in education by race and ethnicity, gender and nationality, with less-studied evidence for socioeconomic status, disability and military-connected status.^[47] Moodle’s built-in “Students at risk of dropping out” model “must be trained on a site with data”, and Moodle advises that models “should also be monitored for performance and accuracy”.^[48]
• Generative AI. UNESCO warns that, without national regulation, institutions are largely unprepared to validate such tools.^[49] AI-drafted items still pass the item quality loop; AI grades are suggestions. For integrity, publish which AI use each assessment permits, and do not treat a detector’s score as proof: a 2023 study found that GPT detectors “consistently misclassify non-native English writing samples as AI-generated”.^[50] Suspected misconduct goes to the assessment board with other evidence (drafts, a viva).

Assumptions: a self-hosted Moodle 4.5 LTS site on Linux with PostgreSQL, a nightly roster feed, three LTI 1.3 tools, vendor packages and quizzes that lead to certificates. Other platforms need other commands. 4.5 is shown because it has security support until 4 October 2027 and the commands were checked against its source; a new site should normally start on 5.3 LTS (released 5 October 2026).^[39]

1. Integration register entry. One entry per tool; the review in operating model and governance fills it in before any learner data flows.

Example status: YAML syntax-checked; illustrative values.

tool: "Example Coding Labs"
owner: "platform-team@example.edu"
standard: "LTI 1.3 with AGS and NRPS"   # never a new LTI 1.1 link
deployment_id: "deployment-01"
data_shared:
  claims: [sub, roles, context]           # no name or e-mail unless needed
  nrps_roster: false
  grade_passback: true
courses: ["course-101", "course-102"]
contract:
  dpa_signed: true
  data_location: "EU"
  retention_after_exit_days: 30
tests:
  sandbox_launch: "2026-10-20"
  passback_verified: "2026-10-20"
exit_plan: "Export scores via AGS line items; download learner work"
review_due: "2027-04-01"

2. Change-window runbook for the LMS. The commands and options below are those of Moodle 4.5’s command-line scripts; run them as the web-server user, as Moodle’s documentation advises.^[51][52][53] Schedule the window outside exam periods.

Example status: syntax-checked with bash -n; control flow executed on 2026-10-23 with stub commands (forced failures in checks.php, the dump and upgrade.php); not run against Moodle. Exit codes and directory and maintenance-mode behaviour were read in the 4.5 source. Paths, user and course names are placeholders.

#!/usr/bin/env bash
# Change window for a self-hosted Moodle 4.5 site. Run as root. Stop at the first error.
set -Eeuo pipefail                         # -E: the ERR trap also fires inside functions
umask 077                                  # dumps and backups readable by owner only
MOODLE_DIR="/var/www/moodle"
PHP_BIN="/usr/bin/php"
WEB_USER="www-data"
BACKUP_DIR="/srv/moodle-backups/$(date +%Y%m%d%H%M)"
run() {                                    # log the step, then run it as the web user
  echo "== $*" >&2
  sudo -u "$WEB_USER" "$PHP_BIN" "$MOODLE_DIR/admin/cli/$1" "${@:2}"
}
checks() {                                 # exit 0 OK, 1 warning; 2 or 3 stops
  local rc=0
  run checks.php -v || rc=$?
  [ "$rc" -le 1 ] || { echo "== check result $rc: stop and investigate" >&2; return 1; }
}
trap 'echo "FAILED: $BASH_COMMAND; site may still be in maintenance mode" >&2' ERR

[ "$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }
# backup.php runs as the web user and refuses a directory it cannot write to.
install -d -m 700 -o "$WEB_USER" -g "$WEB_USER" "$BACKUP_DIR"
checks                                     # warnings are printed; critical stops here
run maintenance.php --enable               # no new attempts after this point
# Database dump (PostgreSQL shown). It holds every learner's grades and personal data.
echo "== pg_dump moodle | gzip" >&2        # not via run(); on failure FAILED names gzip
sudo -u postgres pg_dump moodle | gzip > "$BACKUP_DIR/moodle-db.sql.gz"
# Course backups for courses with live assessments (by shortname).
for course in course-101 course-102; do
  run backup.php --courseshortname="$course" --destination="$BACKUP_DIR"
done
# ... deploy the new code or plugin version here ...
run upgrade.php --non-interactive
run purge_caches.php
run maintenance.php --disable
run scheduled_task.php --list | sed -n '1,20p' # tasks listed (sed reads all: no SIGPIPE)
checks                                     # compare with the first run

Maintenance mode comes before the backups, so no attempt is lost on rollback (CLI scripts still run; web requests get the maintenance page). The backup directory is private and owned by the web user, because backup.php refuses a directory it cannot write to.^[52] checks.php exits 1 on a warning and 2 on an error or critical result,^[53] so checks continues on warnings and stops on worse. The dump holds learner personal data: copy it off the host, encrypted, and delete it when retention ends. With set -E the ERR trap also fires inside run: a failed step prints FAILED after its == line, and the site stays in maintenance mode until someone decides to roll back or continue.

Not covered: restore (restore_backup.php --file=… --categoryid=…), file-store backups and upgrade-specific migrations. A move from 4.5 to 5.x migrates question banks: course-level questions go to automatically created shared banks, category-level ones to a new course, and Moodle Docs list known migration issues and role capabilities to fix afterwards.^[54] Rehearse it on a copy before an exam season.

Objective: compute facility, discrimination and reliability for one quiz and find the item that is hurting the result. Prerequisites: Python 3.8 or later; no LMS, cost or risk; 30 minutes. Status: executed by the author on 2026-10-23 with the synthetic data below.

1. Save the responses as responses.csv (20 synthetic learners, 8 items scored 0 or 1).
2. Save the script as item_analysis.py and run python3 item_analysis.py responses.csv.
3. Read the flags. Then assume a reviewer confirms Q6’s key was wrong: re-key by flipping every Q6 value (0↔1), save as responses-rekeyed.csv, and run again.
4. With a cut score of 6 out of 8, list who passes before and after.

learner,Q1,Q2,Q3,Q4,Q5,Q6,Q7,Q8
L01,1,1,1,1,1,0,1,1
L02,1,1,1,1,1,0,1,1
L03,1,1,1,1,0,0,1,1
L04,1,1,1,0,1,0,1,1
L05,1,1,1,1,1,0,0,1
L06,1,0,1,1,1,0,1,0
L07,1,1,1,0,1,0,1,0
L08,0,1,1,1,0,0,1,1
L09,1,0,1,1,0,1,0,1
L10,1,1,1,0,0,0,1,0
L11,0,1,1,1,0,1,0,0
L12,1,0,1,0,1,1,0,0
L13,0,0,1,1,0,1,1,0
L14,1,0,1,0,0,1,0,0
L15,0,1,1,0,0,1,0,0
L16,0,0,1,0,1,1,0,0
L17,0,0,1,0,0,1,0,1
L18,0,0,1,0,0,1,0,0
L19,0,0,1,0,0,0,0,0
L20,0,0,1,0,0,1,0,0

Example status: verified by execution (Python 3, standard library), 2026-10-23.

"""Classical item analysis for one dichotomously scored test (0/1 per item).

Usage: python3 item_analysis.py responses.csv
Columns: learner id, then one column per item. Standard library only.
"""
import csv
import math
import sys
from statistics import mean, pstdev


def pearson(xs, ys):
    """Pearson correlation; returns None when either list has no variance."""
    sx, sy = pstdev(xs), pstdev(ys)
    if sx == 0 or sy == 0:
        return None
    mx, my = mean(xs), mean(ys)
    cov = sum((x - mx) * (y - my) for x, y in zip(xs, ys)) / len(xs)
    return cov / (sx * sy)


def load(path):
    with open(path, newline="", encoding="utf-8") as fh:
        rows = list(csv.reader(fh))
    items = rows[0][1:]
    scores = [[int(v) for v in r[1:]] for r in rows[1:] if r]
    return items, scores


def analyse(items, scores):
    n, k = len(scores), len(items)
    totals = [sum(r) for r in scores]
    report = []
    for j, name in enumerate(items):
        col = [r[j] for r in scores]
        rest = [t - c for t, c in zip(totals, col)]  # rest-of-test score
        p = mean(col)
        d = pearson(col, rest)
        band = "easy" if p >= 0.85 else "hard" if p <= 0.50 else "moderate"
        flags = []
        if d is None:
            flags.append("no variance: cannot discriminate")
        elif d < 0:
            flags.append("NEGATIVE: check key")
        elif d < 0.10:
            flags.append("poor discrimination")
        report.append((name, p, band, d, flags))
    item_var = sum(pstdev([r[j] for r in scores]) ** 2 for j in range(k))
    total_var = pstdev(totals) ** 2
    alpha = (k / (k - 1)) * (1 - item_var / total_var)
    sem = pstdev(totals) * math.sqrt(1 - alpha) if alpha < 1 else 0.0
    return n, k, totals, report, alpha, sem


def main(path):
    items, scores = load(path)
    n, k, totals, report, alpha, sem = analyse(items, scores)
    print(f"learners={n} items={k} mean_total={mean(totals):.2f} "
          f"sd_total={pstdev(totals):.2f}")
    print(f"{'item':<5}{'p':>6} {'band':<9}{'r_rest':>7}  review flags")
    for name, p, band, d, flags in report:
        dtxt = "n/a" if d is None else f"{d:.2f}"
        print(f"{name:<5}{p:6.2f} {band:<9}{dtxt:>7}  {', '.join(flags)}")
    print(f"alpha={alpha:.2f} sem={sem:.2f} (raw-score points)")
    if n < 100:
        print(f"note: n={n} is small; treat statistics as signals for review")
    return 1 if any("NEGATIVE" in " ".join(r[-1]) for r in report) else 0


if __name__ == "__main__":
    sys.exit(main(sys.argv[1]))

Expected output (step 2, from the author’s run; exit code 1 because an item is negative):

learners=20 items=8 mean_total=4.25 sd_total=1.64
item      p band      r_rest  review flags
Q1     0.55 moderate    0.47
Q2     0.50 hard        0.40
Q3     1.00 easy         n/a  no variance: cannot discriminate
Q4     0.45 hard        0.43
Q5     0.40 hard        0.30
Q6     0.50 hard       -0.74  NEGATIVE: check key
Q7     0.45 hard        0.43
Q8     0.40 hard        0.47
alpha=0.41 sem=1.26 (raw-score points)
note: n=20 is small; treat statistics as signals for review

Step 3 (re-keyed): Q6 becomes 0.74, alpha rises from 0.41 to 0.79, the standard deviation from 1.64 to 2.36, SEM 1.08, exit code 0. Step 4: at a cut of 6, 5 learners pass before and 8 after; L06, L07 and L08 move from 5 to 6 points.

How to read it. The bands follow the University of Washington’s ScorePak conventions (difficulty “easy” at 85 % or above, “hard” at 50 % or below; discrimination “good” above .30, “poor” below .10; reliability .70–.80 “Good for a classroom test”), one institution’s practice, with its caveat: “Item analysis data are tentative.”^[55] Discrimination is computed against the rest-of-test score, as in Moodle.^[22] Q3 carries no information; a negative item means a wrong key or an ambiguous question, and only an expert reading tells you which, so step 3 is a decision, not an automatic fix.

Validation: on a real export, set the report’s “Calculate statistics from” option to the attempts you exported (in Moodle 4.5 it defaults to the quiz’s grading method, not the first attempt^[56]), and compare Moodle’s percentages with this script’s values × 100.^[22] They should then match within rounding. Troubleshooting: ValueError: invalid literal for int() means a non-numeric cell (blank or partial credit); this script handles 0/1 only. ZeroDivisionError means every learner scored the same total. Teardown: delete the files; they contain no real data. If you export real responses, pseudonymise learner IDs first.

Objective: catch structural and privacy faults in two interoperability artefacts before a vendor test. Prerequisites: Python 3.8 or later; no network, cost or risk. Status: executed by the author on 2026-10-23.

1. Save the statement, the decoded launch payload and the script below.
2. Run python3 interop_check.py statement statement.json and python3 interop_check.py launch launch.json.
3. Break them: replace the statement’s account with "mbox": "mailto:learner@example.edu"; in the launch, delete the deployment_id claim and set the version claim to "1.1". Run both again.

Example status: JSON syntax-checked; both files passed the script below.

{
  "id": "3f9d2c1e-8a47-4b6e-9f0a-2d1c5e7b8a90",
  "actor": {
    "objectType": "Agent",
    "account": {"homePage": "https://lms.example.edu", "name": "learner-7f3a"}
  },
  "verb": {
    "id": "http://adlnet.gov/expapi/verbs/passed",
    "display": {"en-US": "passed"}
  },
  "object": {
    "objectType": "Activity",
    "id": "https://lms.example.edu/xapi/activities/course-101/final-quiz",
    "definition": {"name": {"en-US": "Course 101 final quiz"}}
  },
  "result": {
    "score": {"scaled": 0.8, "raw": 20, "min": 0, "max": 25},
    "success": true,
    "completion": true,
    "duration": "PT34M12S"
  },
  "context": {
    "registration": "6c1d8e2f-4b3a-4f9e-8d7c-1a2b3c4d5e6f",
    "platform": "Example LMS"
  },
  "timestamp": "2026-10-23T09:41:00Z"
}

{
  "iss": "https://lms.example.edu",
  "aud": "tool-client-id-123",
  "sub": "a6d5c443-1f51-4783-ba1a-7686ffe3b54a",
  "exp": 1792750000,
  "iat": 1792749700,
  "nonce": "n-0S6_WzA2Mj",
  "https://purl.imsglobal.org/spec/lti/claim/message_type": "LtiResourceLinkRequest",
  "https://purl.imsglobal.org/spec/lti/claim/version": "1.3.0",
  "https://purl.imsglobal.org/spec/lti/claim/deployment_id": "deployment-01",
  "https://purl.imsglobal.org/spec/lti/claim/target_link_uri":
    "https://tool.example.com/launch",
  "https://purl.imsglobal.org/spec/lti/claim/resource_link":
    {"id": "rl-200417"},
  "https://purl.imsglobal.org/spec/lti/claim/roles": [
    "http://purl.imsglobal.org/vocab/lis/v2/membership#Learner"
  ],
  "https://purl.imsglobal.org/spec/lti/claim/context":
    {"id": "course-101", "title": "Course 101"}
}

Example status: verified by execution (Python 3), 2026-10-23.

"""Pre-flight checks for two interoperability artefacts (structure only).

  python3 interop_check.py statement statement.json   # xAPI Statement
  python3 interop_check.py launch launch.json         # decoded LTI 1.3 launch
Does NOT verify signatures, nonces or expiry: the receiving system must.
"""
import json
import sys

LTI = "https://purl.imsglobal.org/spec/lti/claim/"
LTI_REQUIRED = ["message_type", "version", "deployment_id",
                "target_link_uri", "resource_link", "roles"]
ACTOR_IFIS = ["mbox", "mbox_sha1sum", "openid", "account"]


def check_statement(s):
    problems = []
    for prop in ("actor", "verb", "object"):
        if prop not in s:
            problems.append(f"missing required property: {prop}")
    actor = s.get("actor", {})
    ifis = [i for i in ACTOR_IFIS if i in actor]
    if len(ifis) != 1:
        problems.append(f"actor needs exactly one identifier, found {ifis}")
    if "mbox" in ifis:
        problems.append("privacy: actor exposes an e-mail; prefer account")
    if not str(s.get("verb", {}).get("id", "")).startswith(("http://", "https://")):
        problems.append("verb.id must be an IRI")
    scaled = s.get("result", {}).get("score", {}).get("scaled")
    if scaled is not None and not -1 <= scaled <= 1:
        problems.append("result.score.scaled must be between -1 and 1")
    return problems


def check_launch(c):
    problems = [f"missing claim: {n}" for n in LTI_REQUIRED if LTI + n not in c]
    if c.get(LTI + "version") != "1.3.0":
        problems.append("version claim must be 1.3.0")
    if not c.get(LTI + "resource_link", {}).get("id"):
        problems.append("resource_link.id is required")
    if "sub" not in c:
        problems.append("no sub: anonymous launch, grades cannot be returned")
    return problems


def main(kind, path):
    with open(path, encoding="utf-8") as fh:
        doc = json.load(fh)
    problems = check_statement(doc) if kind == "statement" else check_launch(doc)
    for p in problems:
        print("FAIL", p)
    print("OK" if not problems else f"{len(problems)} problem(s)")
    return 1 if problems else 0


if __name__ == "__main__":
    sys.exit(main(sys.argv[1], sys.argv[2]))

Expected output (author’s run): step 2 prints OK twice, exit 0. Step 3 prints FAIL privacy: actor exposes an e-mail; prefer account (exit 1), then FAIL missing claim: deployment_id and FAIL version claim must be 1.3.0 (exit 1).

Where the rules come from. The xAPI 1.0.3 text requires actor, verb and object, one identifier per Agent, and a scaled score between -1 and 1.^[20] An xAPI vendor’s summary of 2.0 says the requirements did not change significantly (MUST became SHALL);^[30] check these rules against the 2.0 text if your LRS uses it. The e-mail rule is this page’s privacy choice, after cmi5’s advice against sensitive PII in the launch actor.^[10] The LTI checks are the required claims of an LtiResourceLinkRequest.^[11] Validation: the script is a pre-flight, not a conformance test. Real tools must also verify the token’s signature, issuer, audience, expiry and nonce,^[28] and an LRS can be tested with ADL’s conformance suite, which its README says “should also not run against a production LRS endpoint because the data is persisted and never voided”.^[57] Troubleshooting: json.decoder.JSONDecodeError usually means a trailing comma. Teardown: delete the files.

Objective: prove, before a real sitting, that the team can apply an accommodation and correct a key without corrupting results. Prerequisites: a non-production Moodle 4.5 (or equivalent) site with three test accounts; teacher and admin rights; two hours. Risk: none if the site is a sandbox; never run this drill in a live course. Status: not executed for this page; the steps follow Moodle 4.5 documentation.

1. Create a course and a 10-minute timed quiz with five auto-marked questions; deliberately set one wrong key.
2. Add a user override giving one learner 25 minutes; user overrides take precedence over group overrides.^[58]
3. Attempt the quiz as all three learners; only the overridden learner should see 25 minutes.
4. Open the statistics report and find the faulty item (low or negative discrimination; Moodle highlights low values in red).^[59]
5. Fix the key, run a dry-run regrade, compare, then regrade.^[60]
6. Record the decision in the regrade decision record.

Expected output (not executed): only the overridden learner had 25 minutes; the dry run previews the grade changes; afterwards the gradebook matches the preview. Validation: a second person re-derives one grade by hand. Troubleshooting: a missing override usually means wrong group membership;^[58] if nothing changes, “Regrading isn’t always possible”, for example after the number of answers changed.^[60] Teardown: delete the course, for example with sudo -u www-data /usr/bin/php admin/cli/delete_course.php --courseid=<id> --disablerecyclebin on the sandbox (without the flag, an enabled recycle bin keeps a course backup),^[61] and delete the test accounts.

Scenarios 1–3 are illustrative; 4 and 5 are sourced public events.

Pitfalls. (1) Reusing a small bank until items circulate; Standard 6.7 makes protecting test materials the test user’s responsibility “at all times”.^[23] (2) A statistically defensible method can still fail individuals; plan appeals capacity.

Leading and lagging. Enrolment, passback and accommodation measures lead complaints and appeals; regrades, appeals and revocations lag.

Targets: set from your own baseline and stakes; we found no published benchmarks. Investigate every accommodation miss.

Jurisdiction matters and this section is not legal advice; detailed privacy work belongs to PrivacyOps.

• Accessibility. WCAG 2.2 (a W3C Recommendation since 5 October 2023; current edition 12 December 2024) Success Criterion 2.2.1 requires that time limits can be turned off, adjusted or extended, with exceptions including “Essential Exception: The time limit is essential and extending it would invalidate the activity”.^[62] For a timed exam, document why time is essential and still apply individual extra time. In the US, the Justice Department’s rule covering “Public schools, community colleges, and public universities” requires WCAG 2.1 AA from 26 April 2027 for public entities with a total population of 50,000 or more, or 26 April 2028 for smaller ones, dates set by a 20 April 2026 interim final rule. A school district is not a special district: it uses the population of its city or county, or, if independent, the most recent Small Area Income and Poverty Estimates.^[63]
• Privacy. In the US, FERPA applies to educational agencies and institutions that receive funds under programmes the Secretary of Education administers.^[64] Operationally: share minimal claims with tools, pseudonymise analytics exports, set retention per record type, and log access to grades.
• Proctoring. In Ogletree v. Cleveland State University (N.D. Ohio, August 2022) a pre-exam room scan of a student’s bedroom was held an unreasonable Fourth Amendment search; the Future of Privacy Forum notes it is one fact-dependent district ruling and “it is too soon to tell whether other courts will follow suit”.^[65] For the EU, see automation and AI.
• Security. Apply platform advisories promptly;^[40] review plug-ins before installing; time-box vendor support access; protect item banks as confidential (Standard 6.7).^[23]

Accessibility is a release criterion for each course run, not a one-off audit. The checks cite WCAG 2.2 success criteria (Level A unless marked AA);^[62] at design time, UDL 3.0 helps.^[34]

When. Run the content checks in the course launch readiness review and when a course is revised. Run the tool checks before procurement: ask for an Accessibility Conformance Report, the report format built on a completed ITI VPAT, in its WCAG, Section 508, EU (EN 301 549) or international edition,^[67] and test the parts learners will use.

How. Checkers assist but do not decide: tools “can not determine accessibility, they can only assist in doing so”.^[68] Moodle 4.5 ships an Accessibility toolkit that checks content in core activities once the site registers with Brickfield;^[69] add a manual keyboard and screen-reader pass on assessment pages.

Counting the KPI. Log one defect per failed success criterion per content item; close it only when fixed and re-checked. A defect that blocks an assessment is escalated like a wrong grade.

• Peaks are predictable: term start, deadlines, exam windows. Load-test a timed quiz with the expected simultaneous starts before the window; capacity engineering belongs to WebOps and SysOps.
• Cost drivers: hosting or subscription (check how the contract counts users), tool licences, proctoring, item writing and review, accessibility remediation. A reviewed item is a durable asset until exposure makes it worthless.
• Lifecycle costs: each integration adds review, upgrade testing and an exit cost. Moodle LTS releases get 36 months of security fixes,^[39] which lowers upgrade frequency but not the need to rehearse upgrades.
• Sustainability: mainly hosting, video and media retention; GreenOps covers the method.

• Reconciliations: roster vs system of record; gradebook vs passback logs; credentials issued vs grades released.
• Sampling: each term, trace a random sample of credentials back through every link of the evidence chain.
• Item review evidence: every live item has a reviewer, a version and statistics after use.
• Exception monitoring: overrides created after a sitting began; grades edited after release; credentials revoked.
• Audit trail: who changed which result, when and why; append-only (principle 3).

flowchart TB
  S["Signal: negative discrimination or learner reports"] --> H["Hold grade release and certificates"]
  H --> J{"Expert review: key wrong or item ambiguous?"}
  J -->|"key wrong"| K["Fix key as a new question version"]
  J -->|"ambiguous"| A["Board decides: credit all or remove item"]
  K --> D["Dry-run regrade, compare with expectations"]
  A --> D
  D --> R["Regrade, recompute pass and fail"]
  R --> C["Issue, re-issue or withdraw credentials"]
  C --> N["Tell affected learners what changed and why"]
  N --> L["Record decision; add review step to prevent repeat"]
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  class S,H risk
  class J decision
  class K,A,D,R,C,N,L core

1. Detect. A negative item (Lab 1: Q6 at −0.74), or several learners report the same question.
2. Contain. Hold release and automatic certificates; certificates already sent are marked under review, not deleted.
3. Diagnose. Two subject experts read the item independently; statistics say where to look, not what is wrong.
4. Decide. Re-key, credit all answers, or remove the item and rescale; record the rationale, as Standard 5.21 expects for cut-score procedures.^[23]
5. Dry run. Preview the regrade^[60] and check it matches the decision. In Lab 1, re-keying moved three learners across a cut of 6.
6. Apply. Regrade; recompute pass and fail; issue new credentials and revoke any that no longer hold.
7. Communicate with every affected learner, including anyone told a different result earlier.
8. Learn. Add the missing control (usually a second-reviewer key check) and log the incident.

Rollback: keep the pre-regrade export; if the decision is overturned on appeal, the earlier state can be restored under a new recorded decision.

• “The LMS is the assessment strategy.” A quiz engine produces numbers, not validity. Without a blueprint and cut-score rationale, a pass mark is a guess.
• “Completion equals competence.” Completion shows exposure; only assessment evidence supports a competence claim.
• “More proctoring, more integrity.” Surveillance adds legal, privacy and accessibility risk; assessment design (item pools, applied open-book tasks) often protects integrity better.
• “xAPI will fix our data.” Without agreed verbs, activity IDs and identifiers, an LRS collects statements that do not join up.
• “Analytics should flag at-risk students automatically.” Models trained on biased history can repeat it;^[47] use them to prompt human contact, and audit them.

Use a deliberate learning-operations function when results carry consequences (grades, certificates, compliance), when several systems exchange learner data, or when cohorts are large enough that manual fixes stop scaling.

Do not build one when learning is informal and unassessed (good onboarding and KnowledgeOps may suffice), when one course runs once on default settings, or when the gap is the programme itself (PeopleOps). Hidden costs: item writing and review, integration upkeep, and the discipline of change freezes.

How much rigour. This tree (this Atlas’s proposal) maps when to use and when not to use onto the maturity model.

%%{init: {"flowchart": {"wrappingWidth": 120, "nodeSpacing": 30}}}%%
flowchart TB
  Q0(["Is the gap what to teach, to whom, on what budget?"])
  Q0 -->|no| Q1(["Consequential results, linked systems or large cohorts?"])
  Q0 -->|yes| P["Programme decision: PeopleOps or curriculum committee"]
  Q1 -->|no| N["Do not build a function: onboarding, KnowledgeOps"]
  Q1 -->|yes| Q2(["Do results carry consequences?"])
  Q2 -->|yes| Q3(["Do third parties rely on the result?"])
  Q2 -->|no| M["Level 2: integration register, reconciliations"]
  Q3 -->|no| EV["Level 3: blueprints, cut scores, item analysis"]
  Q3 -->|yes| AS["Level 4: add verifiable credentials, sampled audits"]
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class Q0,Q1,Q2,Q3 decision
  class M,EV,AS core
  class P,N neutral

Which standard at which boundary. Answer every question; one integration may need several standards.

The LTI resource-link launch is defined without any grade service; grade return is an optional Advantage service.^[11][18] If no question applies, no standard is needed.

Assumptions: the standard is supported in the versions you run (verify with the vendor’s conformance listing, such as 1EdTech’s TrustEd Apps directory^[18]); and someone will own the integration after launch.

This is this Atlas’s model, not an industry standard.

Accessibility checks start at level 2: where the law requires them, they are a baseline.

Term or cohort start (two weeks before)

• Roster reconciliation within tolerance; exceptions ticketed
• Every LTI tool in the register launches, and returns a test grade, in a sandbox course
• Packages tested in the production LMS version
• Accommodation overrides created and checked against approvals
• Change freeze dates published

Exam window

• Load test done for expected simultaneous starts
• Support rota and escalation to the assessment lead
• Release and certificates held until item analysis is reviewed

Credential issue

• Grades released and no holds open
• Credential carries a verifiable identifier and does not depend on the course existing
• Revocation path tested

Termly governance review

• KPIs reviewed; accessibility defects triaged; integration reviews due; retention applied

Assessment blueprint and cut-score rationale

ASSESSMENT BLUEPRINT
Assessment: ____________   Version: ___   Owner (assessment lead): __________
Purpose (what a pass is meant to show): ____________________________________
Stakes: low / medium / high      Learners per sitting (expected): ______
Outcome / topic           Weight %   Items   Item types       Cognitive level
------------------------  --------   -----   --------------   ---------------
________________________  ____       ___     ______________   _______________
Cut score: ___ / ___   Method and panel (names, date): _____________________
Rationale (why this score separates the groups that matter): ________________
Accommodations allowed: ____________   Time limit essential? yes/no, why: ____
Review: items peer-reviewed by ______  Item analysis after each sitting: yes

Regrade decision record

REGRADE DECISION RECORD                     ID: RG-____   Date: __________
Assessment and version: ______________   Sitting: ______________
Signal: negative discrimination / learner reports / other: ________________
Item(s) and expert findings (two reviewers): _____________________________
Decision: re-key / credit all / remove item and rescale / no change
Rationale: ______________________________________________________________
Dry run checked by: ______   Learners affected: ___   Pass/fail changes: ___
Credentials issued / re-issued / withdrawn: ______________________________
Learners informed on: __________   Prevention step: _______________________
Approved by (assessment lead or board): _____________

Course launch readiness record

COURSE LAUNCH READINESS                      Course: ________  Run: ______
Owner: ________   Platform version: ________   Launch date: __________
[ ] Enrolment source and reconciliation result: ____________________
[ ] Tools (standard, version, passback tested): ____________________
[ ] Packages (standard, tested in this LMS version): _______________
[ ] Accessibility check (WCAG level, defects open): ________________
[ ] Assessments: blueprint ref ____, overrides ____, release date ____
[ ] Credential template and verification tested: ___________________
Sign-off: platform ________  assessment ________  course owner ________

Who owns mandatory training: HR or EduOps? In this Atlas, PeopleOps owns who must take what and when; EduOps delivers it and produces the completion records that ComplianceOps uses as evidence.

Do small cohorts make item analysis useless? No, but noisy: with 20 learners, statistics choose which items experts re-read (see the item quality loop).

Should we still accept SCORM? Yes, where it is the format your LMS and vendors support well; SCORM 1.2 is the safe choice on Moodle.^[27] Plan cmi5 where your platforms support it.

Is a timed exam an accessibility violation? Not in itself. WCAG 2.2 allows an essential time limit,^[62] and the testing Standards expect accommodations that remove construct-irrelevant barriers.^[23] Document both.

Can AI grade essays for us? It can draft scores, but in the EU systems that evaluate learning outcomes are high-risk (Annex III), with requirements from 2 December 2027;^[42][45] everywhere, keep human review and monitor for bias.

• Verifiable credentials. Open Badges 3.0 packages achievements as W3C verifiable credentials;^[17][16] issuer key management and revocation become operational duties.
• Two xAPI versions, and cmi5. xAPI 2.0 (IEEE 9274.1.1-2023) is the current version;^[14][13] expect LRSs and content to speak 1.0.x and 2.0 side by side for years.^[30] Wider cmi5 support would reduce reliance on SCORM.
• Learning analytics. SoLAR’s 2026 definition stresses “theoretically relevant and actionable insights”:^[70] analytics tied to a teaching action, with known error rates.

Assumptions: about 400 candidates a year in several countries; the credential matters to employers; budget allows either option; some candidates need extra time.

Why A is attractive: it looks like the paper exam, keeps the existing items, and the vendor promises integrity.

Why A can be wrong here: a US district court found a pre-exam room scan unconstitutional at a public university, with uncertain reach;^[65] in the EU, AI that monitors students during tests is high-risk and emotion inference is banned;^[42][43] recordings become a retention liability; and closed-book recall may be weak evidence for a profession that works with references open. B’s costs are real: new items, a new cut-score study, assessor time.

Decision process: write down what a pass must show, since validity belongs to that interpretation;^[23] list threats (impersonation, collusion, item exposure); pick the cheapest control per threat (identity check, large pool, applied tasks, viva sample); only then ask whether monitoring is still needed and lawful where candidates sit. Uncertainty: whether B reduces misconduct is not established; pilot one sitting and compare item statistics, appeals and candidate feedback.

After this page you can: explain the evidence chain; choose standards per boundary; set accessibility checks; run and interpret a classical item analysis; design a regrade under control; set and calculate learning-operations KPIs; and recognise legal and ethical limits on proctoring and AI.

“EduOps” is a weak label for an important job. Learning operations decides whether a grade, a certificate or a completion record can be trusted, and that trust is built link by link: the right learner, an accessible experience, an assessment whose scores support the claim made for them, a grade that arrived, a credential that verifies, and a record that changes only under control. The standards are mature enough to connect the systems; the hard part is the judgement in the middle: what a pass should mean, when a statistic is a fault, and when surveillance costs more than it protects. Keep those decisions human, written down and reviewable.

Sources were opened on 2026-10-23. Product, version and legal facts are time-sensitive; the evidence ledger records support strength and sources that could not be fetched.

Term status and naming

Interoperability standards

Platforms and tools

Assessment, design and analytics

Law, accessibility and policy (not legal advice)

Cases

Further reading

• Standards for Educational and Psychological Testing (2014), PDF, chapters 1 (validity), 3 (fairness), 4 (test design) and 6 (administration).

Changelog

• 2026-10-23: first draft by the managing author; labs executed.
• 2026-10-23: revision after review r1 (reviews/eduops-r1-response.md): xAPI 2.0, runbook, decision tree, accessible learning, ADA threshold, Moodle defaults, RACI, diagrams, AI Act, hosted LMS, generative-AI integrity.
• 2026-10-23: revision after the final QA score (reviews/eduops-r2-response.md): runbook error handling, workflow query branch, decision framework (adoption tree, standards table), Canvas beta LTI note.
• 2026-10-23, post-score polish: maturity levels aligned with the tree and accessibility law; dump step logged; UNESCO and Baker–Hawn re-checked.