LMS Educational Tool Interoperability Plugin Review Spec

Role: Higher Education Enterprise Software Architect and LMS Integration Security Specialist.

Context

• Higher Ed Entity: {{institution_name}}
• LMS Platform: {{lms_platform_target}}
• Protocol Standard: {{lti_protocol_version}}
• Data Classification: {{student_pii_classification}}
• Integration Provider: {{third_party_vendor_name}}
• Rate Limit Boundary: {{api_rate_limit_policy}}

Task

Produce an integration-focused code review specification to audit middleware code and plugin repositories connecting {{third_party_vendor_name}} services into {{institution_name}}'s {{lms_platform_target}} environment.

Method

1. Define security audit checks for {{lti_protocol_version}} asymmetric cryptographic handshakes, JWKS endpoint validation, and OIDC state validation.
2. Detail static code review checks for handling {{student_pii_classification}} data, ensuring zero unencrypted log persistence of student records.
3. Establish code inspection criteria for roster sync routines, Assignment and Grade Services (AGS), and Names and Role Provisioning Services (NRPS).
4. Specify code review patterns to ensure client requests strictly obey {{api_rate_limit_policy}} with exponential backoff and jitter.
5. Create session management review checks enforcing ephemeral token storage and preventing cross-tenant token pollution.
6. Formulate failure mode review criteria ensuring LMS core stability during downstream third-party service outages.
7. Detail auditing criteria for role-based access control (RBAC) ensuring student accounts cannot trigger instructor-privileged grade writeback endpoints.

Constraints

• MUST reject any implementation storing raw student credentials or static shared API secrets.
• MUST require explicit encryption at rest and in transit for all data labeled {{student_pii_classification}}.
• Audit criteria must align strictly with {{lti_protocol_version}} security guidelines.
• Do not include vendor commercial terms; focus exclusively on source code, schema, and API architecture.

Output format

Provide the code review specification organized under these headers:

• 1. Authentication & {{lti_protocol_version}} Protocol Conformance Checks (6 requirements)
• 2. Student Privacy & Data Hygiene Verification (4 strict checks for {{student_pii_classification}})
• 3. Grade Service & Sync Pipeline Resilience Rules (4 criteria)
• 4. API Governance & Rate Management Spec (verifying {{api_rate_limit_policy}})
• 5. Security Sign-off Gate Criteria (binary pass/fail checklist)

Self-review

• Verify that all context variables are embedded into actionable software review assertions.
• Ensure the checks distinguish clearly between instructor and student LTI launch roles.
• Confirm that data privacy checks reflect FERPA and higher education compliance norms.