Security-First LMS Integration — LTI 1.3, Explicit RAG, and Course-Scoped Control
Campus IT teams don’t need another “magic” integration; they need one that’s predictable, auditable, and easy to govern. That’s why mentorAI connects to your LMS the standards-aligned way:
LTI 1.3 / LTI Advantage for the launch,
admin-approved API keys (only if you want content ingestion), and
course-scoped links so access is exactly as wide—or narrow—as you intend. No scraping, no shadow permissions, no surprises.
Start With The Standard, Not a Workaround
mentorAI is registered as an
LTI 1.3 tool at the institution level. Your LMS admin adds our OIDC login, redirect (target link) URIs, and keyset (JWK) URL, then chooses placements the same way they would for any other trusted tool. That gives you a well-understood security posture (signed launches, role/context claims), plus clear toggles for what’s on and what stays off—like
Assignments & Grade Services (AGS) and
Names & Roles (NRPS).
The result: instructors click a link, we get the sanctioned LTI launch, and the mentor opens with the right context—nothing more.
What This Looks Like In Each LMS
- Canvas: Admins create a Developer Key (LTI 1.3) and add the app by Client ID. Instructors place the mentor as a Module → External Tool item or in course navigation.
- Blackboard (Ultra & Original): In Ultra, instructors add Teaching Tools with LTI Connection; in Original, Build Content → Web Link marked as LTI. Visibility controls keep student access explicit.
- Brightspace (D2L): Admins Register Tool under LTI Advantage, then Create a Deployment and Create a Link to the specific mentor. Instructors add it as an External Learning Tool activity.
Across all three, the pattern is the same: the
link points to a specific mentor, which keeps scope tight and predictable.
Retrieval-Augmented Generation (RAG) the Explicit Way
We support two secure, opt-in paths for grounding answers in authoritative materials:
- Instructor-managed uploads. Faculty drag-and-drop approved course files (syllabi, slides, PDFs) into mentorAI. RAG cites those exact sources back to students. No LMS API access is involved.
IT-approved LMS ingestion. If you want mentors to index course content directly from the LMS, your IT team provisions scoped LMS API credentials. Only then do mentors pull permitted files. Nothing is auto-ingested by default.
Either way, every response is
citation-first, so instructors and students see where information came from.
Course-Scoped Access and Role-Aware Behavior
A single LTI link maps to
one mentor. That mentor’s knowledge base, safety policies, and features are defined at the course (or department) level. LTI roles determine what users can do—e.g., instructors see analytics and settings; learners just chat and complete activities. If you enable AGS, mentors can post scores back to the LMS; if you leave it off, mentors remain read-only.
Why Security Teams Like This Model
- Familiar controls. You manage keys, placements, and scopes using the tools your LMS already provides.
- No hidden data flows. We don’t crawl the LMS; ingestion only happens with explicit uploads or admin-approved API credentials.
- Easy to roll out, easy to roll back. Start in a few courses, add links as confidence grows, and only enable gradebook or roster access when there’s a clear need.
- Clear auditability. LTI launches and any optional API calls are visible to your LMS admins. Within mentorAI, every grounded answer carries source citations.
A Simple Path to Pilot (and Scale)
- Pick one course where a mentor adds immediate value (e.g., large enrollment or heavy Q&A).
- Register mentorAI via LTI 1.3 and add the course link.
- Choose your RAG path: instructor uploads only, or IT-approved LMS API ingestion.
- Run for the duration of the pilot. Instructors keep full control (factory defaults that just work; deeper prompt/pedagogy settings when they want them).
- Review analytics and citations with faculty and IT, then decide where to expand next.
Want To See This in Action?
- Short walkthroughs: Our setup guides for Canvas, Blackboard, and Brightspace show the exact admin steps and placements we support, and can be found at docs.ibl.ai.
- Live demo: We’ll embed a mentor in a sandbox course and ground it on your materials so you can test citation quality and controls.
- Next steps: DM us on LinkedIn or visit ibl.ai/contact to schedule a 20-minute fit check with your LMS admin and security lead.
mentorAI integrates the way your LMS expects, gives instructors real control, and keeps your governance clean—so you can move fast without cutting corners.