Version 3.6 Highlights
Privacy-safe individual student analysis in Chat
The class chat can now cross-reference per-student educational indicators — grades, interactions, engagement, access, completion, and pending activities — without sending real student identities to the external AI provider. Moodle creates request-scoped aliases (e.g. Student-001) before transmission and restores display names locally after the response returns. Email addresses, IP addresses, usernames, enrolment identifiers, and submission content remain blocked by the server-side transport filter.
Pseudonymised forum text in activity analysis
When the AI analyses a forum activity, enrolled student names that appear inside post bodies are replaced with aliases before the corpus is included in the prompt. A second pseudonymisation pass on the full prompt provides defence in depth.
Quiz answer-key access control
Quiz question text and alternatives are always available for AI pedagogical analysis. The correctness markers ([CORRECT]) are transmitted to the external provider only when the initiating user holds the dedicated block/mwa_dashboard:viewanswers capability, which is granted exclusively to the manager archetype by default. Teachers and editing teachers receive question text without the answer key.
Transport-layer allowlisting extended to JSON arrays
The final transport filter in client.php now applies the structured-field allowlist to both scalar JSON values and JSON arrays (e.g. pending activity name lists). Any array field whose key is not explicitly allowlisted is replaced with "field_omitted":null before the request leaves Moodle.
AI audit records data categories per call
The local audit table (block_mwa_dashboard_aiaudit) records the allowlisted category set actually present in each AI call — forum_posts_anonymised, question_text_only, question_answer_key, pseudonymised_individual_metrics, aggregate_context, and others — without storing the prompt or response body. This enables per-operation accountability tracing.
Privacy provider fully revised
classes/privacy/provider.php was rewritten with complete inline documentation covering all four internal tables (log, messages, snapshot, aiaudit) and both external AI endpoints, explaining exactly what data each transmits, which safeguards apply, and under what conditions transmission occurs. All new data categories introduced in 3.6 are declared explicitly.
Dead code removed, capability check optimised
- Removed the unused
ctxMsg text-assembly block (~75 lines) from chat.js — the structured ctx object is the actual transmission path.
- Removed the orphaned
redact_students_from_chat() method from external.php — superseded by pseudonymize_students_for_ai().
- Hoisted the
has_capability('block/mwa_dashboard:viewanswers') call from inside the per-alternative loop to once per quiz analysis request.
