# Assessment Assurance Design Standard

This standard makes graded assessments AI-aware at design time. Generators read it on demand; the assurance-audit references hold the full depth behind each move (`skills/assurance-audit/references/`).

## The Two Design Questions

Every graded assessment answers two questions before it ships:

1. Can a real student's work be told apart from what AI would produce? (authorship and assurance)
2. Does it measure real thinking, and does it build the student's judgment about using AI? (cognitive demand and AI literacy)

The seven levers below turn these two questions into design moves.

## Design Levers

Apply the levers that fit the assessment. When one does not fit, state why in one line rather than skipping it silently.

1. **Secure at least one anchor for the grade** (Two-Lane / assurance tier). Securing is two kinds, both AI-judged from the assessment's actual content: an identity/condition control (proctoring, LockDown Browser -- a deterministic API fact, regex confirms only its presence) or authorship evidence (a dated process trail, drafts, decision logs, revision history, a graded reflection, a graded AI-use appendix -- read and classified from the prompt/rubric/syllabus, not detected by regex). Peer evaluation alone does not secure; it does not verify authorship. Proctoring is the last-resort subtype of the identity kind. At least one high-weight item needs one of these two kinds. **When designing or recommending the anchor, default to authorship evidence; never propose adding a proctored or LockDown Browser assessment as the securing move** -- proctoring may appear only as a bare trailing last-resort clause where authorship evidence genuinely cannot fit (describing an already-proctored item as current secured weight is state, not a recommendation). When naming a securing or design tool, prefer a real ASU-supported tool from `standards/asu-assessment-tools.md` and honor its caveats. A grade resting entirely on uncontrolled items is Counterfeit.
2. **Capture process and authorship evidence** (D5). Drafts, version history, dated logs, a short defense. Prefer this over surveillance.
3. **Grade judgment about AI where AI is allowed** (D4). The student critiques, verifies, improves, or directs AI output and is graded on the quality of that judgment, not on output polish.
4. **Declare task-level AI use** (D1 / AIAS 1-5). State per task what AI use is allowed and require disclosure. A silent policy is the weakest position.
5. **Bind to authentic, course-specific evidence** (Gulikers 5DF / FIRE). Tie the task to a named case, a course dataset, the cohort's own discussion, or the student's professional context, so a generic AI answer reads as generic.
6. **Align Bloom to the outcome, avoid counterfeit demand** (D2). Do not label an auto-graded selected-response quiz as Analyze, Evaluate, or Create. Match the instrument to the level it can actually measure.
7. **Keep it equitable and 7.5-week feasible** (D6). Use scalable, accessible constraints and reusable templates. Proctoring, oral checks, and synchronous checks are a last resort: weak against current AI, unscalable, an access barrier, and a cut against the online-flexibility promise.

## The TILT Pairing Rule

Any "verify, critique, or improve the AI" move ships with two things up front: the rubric, and two or three annotated model examples (Winkelmes TILT). Without the models, the move penalizes students who do not already know the target performance. Tone stays non-adversarial: the goal is to teach judgment, not to catch students.

## Design Moves by Category

Five assessment categories, each with the vulnerable pattern, the highest-value AI-resistant moves, an AI-forward move, and the secured anchor. See `scripts/assessment_design_playbook.py` for the fuller faculty-facing version of this content.

### Quizzes and Exams

Vulnerable: an unproctored, untimed quiz drawn from a static bank functions as an open-book-with-AI test; recall items are exactly what current AI handles best.
AI-resistant: time-box and randomize from a pool large enough that each student sees a different subset; shift from recall to application items that require using a rule on a novel scenario; parameterize the numbers or context so no two items are identical.
AI-forward: an open-AI exam where students verify and correct an AI-generated answer and explain what it missed.
Secured anchor: application items drawn from a large randomized or parameterized pool. Proctoring is a last resort, reserved for the highest-stakes exams only.

### Papers and Written Assignments

Vulnerable: a final-upload-only paper on a reusable prompt gives a student nothing to do but paste, edit, and submit.
AI-resistant: situate the prompt in specific course material or a case discussed only internally; stage the process (proposal, annotated draft, revision with version history) and grade the process, not just the product; require personal or professional situatedness the AI cannot source.
AI-forward: an AI-use appendix where students document which suggestions they accepted or rejected and justify each decision, graded alongside the paper.
Secured anchor: documented process (staged drafts, version history, milestones). A short oral summary on a sampled subset is a last-resort addition for high-weight papers only, not a default requirement.

### Discussions

Vulnerable: async text posts on a generic, reusable prompt carry no authorship signal; a student who never engaged with the material can generate a plausible post in seconds.
AI-resistant: bind prompts to specific named course evidence (a case, a classmate's post, a shared artifact); gate posting so students submit before seeing peers; grade integration and specificity, not length.
AI-forward: ask students to critique an AI-generated response to the same prompt and name what it missed or distorted.
Secured anchor: explicit references to cohort-specific content a generic prompt cannot predict. A voice or video identity signal is optional, not required, and not AI-proof on its own.

### Projects

Vulnerable: deliverable-only grading on a reusable scope is nearly as substitutable as a paper, and a single group submission can hide one contributor's AI-generated section.
AI-resistant: use a unique or local scope (a dataset, client, or problem set specific to this cohort and term); gate with milestone check-ins that create a verifiable development record; require a dated process log or, for code, commit history.
AI-forward: teams keep a log of where AI assisted and what judgment overrode it, graded alongside the deliverable.
Secured anchor: milestone check-ins plus a process log. A brief live demo where each member explains their own contribution adds individual accountability for high-weight or group work.

### Presentations and Oral Assessments

Vulnerable: a pre-recorded presentation with scripted Q&A can be prepared with AI just as a paper can; live video alone is not fully AI-proof unless the exchange is genuinely unscripted.
AI-resistant: make it live, even sampled across a rotating portion of the cohort, with unscripted follow-up questions; ask students to defend specific reasoning choices on the spot.
AI-forward: students present work prepared with AI's help and open by naming where AI contributed and where they overrode it.
Secured anchor: a live exchange with unscripted questions, reserved for high-stakes work given its cost. A sampled oral viva keeps the per-student time burden down while preserving the real-time reasoning check.

## The By-Design Self-Check

Run these three checks before returning a graded assessment:

1. Could a student produce this graded artifact with AI and have it look the same? If yes, add a process or authenticity move, or state in one line why the design does not need one.
2. Does it measure the intended thinking, or recall dressed up as higher order?
3. Is task-level AI use stated?

## House Style Note

Generated assessment content inherits the plugin's house style: plain-language phrasing by default, APA title-case headings, and a stop-slop pass. This file itself carries no em dashes or en dashes, modeling the same rule for generated output.
