# Instructor workflow

> What instructors do from the course-navigation tool — discover assessments, set SEB policy and tools, enable enforcement, and manage passwords.

[Canonical HTML page](https://safeonlineexam.com/docs/operate/instructor)

Instructors work from the **course-navigation** placement of the tool. This page
is a short orientation you can hand to faculty; it is not a policy document.

## First launch [#first-launch]

On first use, the instructor launches the tool from the course and completes
**Canvas OAuth** (the one-time "Connect Canvas" step). This authorizes the API
access the tool needs to read assessments and set access codes. Canvas still
enforces the instructor's actual course permissions.

The first course then starts with a short guided setup: a welcome, the course exit
password when there is no effective managed protection, optional exam tools, and a
first protected assessment. Instructors can return to **Course settings** or an
assessment's settings afterwards; routine resource setup belongs in reviewed exam
tools, while generic URL rules remain under **Advanced website access**.

Each guided step must be valid before **Continue** advances. Password fields show
the same live requirements the server enforces, and incomplete exam-tool
definitions identify the field that needs attention.

## The workflow [#the-workflow]

<Steps>
  <Step>
    ### Refresh assessments [#refresh-assessments]

    Refresh the course to discover published Classic Quizzes and New Quizzes. A learner
    can only use an assessment whose Canvas data is current, verified, published, and
    within its unlock/lock window — the verification window is 24 hours, and a failed
    refresh marks discovery stale rather than exposing a broken exam.
  </Step>

  <Step>
    ### Set course defaults and tools [#set-course-defaults-and-tools]

    Configure course-level start/exit password policy and selected exam tools. Tools
    have an exact HTTPS launch URL and typed resource rules (exact URL, a path and its
    descendants, or a confirmed whole-domain rule). Wildcards, credentials, and
    identity-provider hosts are rejected. A course can hold at most 16 exam tools,
    including school-managed tools; remove an existing tool before adding or copying
    another. Use **Advanced website access** only when an approved exam tool cannot
    express the specific resource an assessment needs.

    New passwords must be 8–128 characters after surrounding spaces are removed,
    contain at least five different letters or numbers, contain no control characters
    or line breaks, and avoid common words, sequences, and repeated patterns. Do not
    reuse the same value for start and exit protection.
  </Step>

  <Step>
    ### Enable SEB on a quiz [#enable-seb-on-a-quiz]

    Enabling requires an **effective exit password** (assessment override, course
    default, or the managed default). The tool creates the access code, writes it to
    the Canvas assessment, and stores SEB state only after Canvas confirms the change.
    The management view never reveals the code. An assessment can override the course
    exit password; reset it to return to the current course or managed default.
  </Step>

  <Step>
    ### Add a quiz-only tool if needed [#add-a-quiz-only-tool-if-needed]

    Define a tool that exists for a single quiz. It stays on that assessment and never
    becomes a course default or appears in other assessments.
  </Step>

  <Step>
    ### Reuse an instructor-owned course tool when appropriate [#reuse-an-instructor-owned-course-tool-when-appropriate]

    Open a saved instructor-owned course tool and choose **Duplicate to courses**.
    Select one or more active courses where the same Canvas user is a teacher. The
    server rechecks that teacher list before writing, appends an equivalent tool
    without replacing the target catalog, and is safe to retry. School-managed presets
    and quiz-only tools cannot be copied this way.
  </Step>

  <Step>
    ### Reveal, rotate, disable as needed [#reveal-rotate-disable-as-needed]

    Passwords are redacted by default; a narrowly bound, short-lived reveal is
    available. You can rotate the access code, reset an assessment to course defaults,
    and disable SEB — which removes Canvas access-code protection through the intended
    action only.
  </Step>
</Steps>

<Callout title="Changing a protected setting forces a re-download">
  The detector sidebar is an affordance; the **SEB URL filter in the generated
  configuration** is what actually controls what can load. Changing any selected
  tool or URL policy changes the configuration fingerprint, so students must download
  a new configuration. Communicate setting changes before an exam window.
</Callout>

## What instructors never see or handle [#what-instructors-never-see-or-handle]

* The raw Canvas access code — it is created, hidden, and rotated for them.
* Any student's private device identity or the encryption private key.
* Another course's data — the tool is scoped to their launch.