- Identity, relationship, role, and learner protection
- Verify people and organizations; bind enrolment, employment, educator, assessor, guardian, representative, support and administrator roles to purpose, programme, scope and time; minimize disclosure; revalidate changes; and apply age, safeguarding, contact and delegated-access requirements where relevant.
- Privacy, minimization, tracking, and records
- Define purpose and authority for each data action, collect the minimum, separate learning evidence from behavioral telemetry, restrict sensitive data and inferences, govern vendor access and model training, disclose meaningful processing, limit retention, support correction and export, and avoid treating surveillance as pedagogy.
- Curriculum, content provenance, and rights
- Bind every resource to an outcome, source, author, right, version, locale, reviewer, pedagogical note, release and retirement state; label generated content; validate citations and links; protect learner work; and stop publication when evidence, permission, accuracy or context is missing.
- Accessibility, accommodation, language, and support
- Design perceivable, operable, understandable and robust web content; test with assistive technology and users; provide meaningful alternatives and accessible destinations; preserve approved accommodations, flexible participation, language support, human help, and a correction path without assuming WCAG covers every need.
- Assessment validity, assistance, integrity, and authority
- Define the construct and inference, blueprint, conditions, items, rubric, scoring, raters, reliability and validity evidence, accommodations, permitted tools and AI, integrity review, uncertainty, moderation, feedback, appeal, and the qualified authority for grade, progress or credential decisions.
- Interoperability, security, availability, and recovery
- Use supported standards where they fit, register tools explicitly, validate issuer, audience, roles and scopes, minimize roster and grade exchange, protect tokens and records, test dependency failure, preserve manual service and exports, reconcile retries, audit changes, and retire integrations deliberately.