My student wants to connect Claude to Canvas -- what do I say?

Thanks for this question, it raises many questions we need to answer!

First, it’s great that your student is able to come and talk about this, rather than simply doing something which may not be acceptable, so I hope you are able to continue with an open dialogue. I think it’s important to ask them exactly what they want to do, and why. My interpretation of the request, and this needs to be checked with the student, is that they want to give Claude access to Canvas as if the software, Claude, were the student. Then Claude reads the materials in Canvas, answers questions, looks for deadlines, etc. “Being used to working with Claude” isn’t a good reason to allow this request: we structure our courses and teaching intentionally so that students challenge themselves during learning, and that shouldn’t be outsourced to an LLM.

However, there could possibly be an accessibility reason the student wants to do this. I can’t think of one right now, but it would be good to ask them so that we can consider whether it is a legitimate request or not. For instance, if it is for text to speech, so they can have pages read out, this is already integrated into Canvas or they can access help from the educational support team for more specialist software. Even with more detail, I don’t think this is going to be an acceptable request, but it might help to identify any accessibility issues. I’ve already mentioned a pedagogical objection, but there are also two potential legal objections (and I am not a lawyer so we will need to follow up). 

The first problem it raises is that it probably means putting their university ID and password into Claude. This might be different at other universities but LU staff, if they look hard enough, can find this document which has a section about students too:  https://www.staff.lu.se/sites/staff.lu.se/files/2023-05/Guidelines-on-information-security-at-Lund-University.pdf which says “Passwords must not be disclosed or stored in such a way that it may become accessible to others” (STYR 2017/947, Appendix 2, section 4.1). A system such as Claude which is not procured (upphandlad) by the university does not represent a secure environment and the passwords could become accessible to others. In addition, breaches to the Claude systems will not be notified to the university.  

Secondly, the materials in the Canvas area are subject to copyright and may not be shared with external people or systems without permission. Personal data on other students may also be available in the Canvas area and under the GDPR may only be saved for legitimate purposes “Personal data may only be processed to the extent and for the purposes that are included within the scope of study.” (STYR 2017/947, Appendix 2, section 3). 

I hope this helps, sorry it was a bit long!

I am fairly close to the “let’s go all in on AI in our teaching” side of the spectrum, yet my immediate thought is that this would be a bad idea. 

While there is a lot to be gained by allowing students to go “all in” on AI use, this has to be balanced by “AI-free zones” to help students recognise the difference between “unproductive” and “productive” struggle, and more importantly, realise the dangers of the real snake in the grass: “unproductive AI-aided success”. So a question is whether “Canvas” should be one of those AI-free zones and why?

But while I am sceptical, I also realise that I have never been a ‘young’ student trying to navigate the Canvas website among all the other noise of university life in a world with social media on all sides, etc. So, I think the best course of action is not to give the student any knee-jerk response (even if we all want to), but instead to engage with the student to figure out what they want to achieve by connecting Claude to Canvas and what the context of this request is. 

Would it be possible to get more information from the student?

I'll quickly highlight another aspect of the significant potential issues with privacy and data integrity surrounding connecting a Large Language Model (LLM) to Canvas. GDPR is built on a dignity concept of privacy that the US lacks, and the major LLMs are US-based [1], so one can argue that an LLM having access to a course Canvas page is counter to the fundamental European value of the dignity of everyone (students, staff, administrators) who are involved in the course.

What I think is more important to think about as a teacher is whether students should be allowed to have a single way of working (even if it 'works for them'). Post-degree a student simply cannot expect to work within their preferred system (even if freelance or in research). There are always systems that one simply has to adapt to, and to which one would never be allowed to grant a LLM access (e.g., what about doing one's tax return?). Thus a student wanting to only use their preferred approach to studying seems to be betraying that they have a shallow understanding of what it means to learn and study at university: their goal seems to be content mastery and nothing else (and their experience has been that an LLM makes that 'easier'). For example, they are not learning how to be in the world, how to work with different systems, how to navigate formal structures.

Quite frankly, it's disturbing that these aspects, that I wouldn't even consider part of the 'hidden curriculum' [2], because these are skills for life, not just about succeeding at university, may need to be made part of the formal (explicit) curriculum of university studies. Imagine, every course that is taken predominantly by first year students at the start of their first term has an intended learning outcome 'students will learn to navigate formal university systems (e.g., the learning management system) and appreciate that organisations use a range of specialised systems with specific purposes'? That feels more than a little patronising to me, but maybe that's what generative 'AI' is going to force academia into: catering to the lowest common denominator of possible understanding while teachers have to assume sufficient individual intelligence for university studies. (I cannot help but think this would also force teachers into a horribly uncomfortable state of hypocrisy, and make it much harder to teach with a 'growth mindset'.)

[1] Whitman, J. Q. (2004). The two western cultures of privacy: Dignity versus liberty. The Yale Law Journal, 113(6), 1151–1221. https://doi.org/ 10.2307/4135723

[2] Snyder, B. R. (1971). The Hidden Curriculum. MIT Press.

---

P.S.: An argument might be that the student must obtain informed consent from everyone who is a member of the course Canvas page. Because access to the personal data is not 'legitimate interest'; a LLM does not have any legitimate interest in the personal data of students taking a course; it it could be argued, then there would be no reason for course pages to require a log in. One missing consent form, even of a student who decided to not take the course, prevents the whole. The teacher who has their doubts may also refuse to give their consent, and even advise (with reason) students against giving theirs. Moreover, consent can be retracted at any time, and the retraction of a single person's consent should be followed immediately by the removal of the LLM's access (arguably, managing the consent should be the teacher or course administrator's responsibility, though the student should make the request unsupported). And this must be repeated with every single course.