The Answer Key Is a Permission Boundary

The Answer Key Is a Permission Boundary

A quiz answer key is not merely hidden learner content. It is a controlled asset that determines whether assessment data remains valid. In a bank academy, the same authoring workspace may contain draft modules, correct answers, reviewer notes, customer examples with PII, and unpublished compliance guidance. Treating the workspace as one readable knowledge base turns each connected search tool or AI agent into a potential disclosure path.

That is the real AI content authoring security problem. Page-level permissions decide who can open a course. They do not, by themselves, decide who can search an answer, export a field, retrieve it through an agent, or publish it into another tenant. Effective quiz answer key access control must apply to the property and to the operation.

Course permissions stop too early

A course record needs distinct controls for fields such as learning copy, answer key, hint, reviewer rationale, learner evidence, customer references, policy status, and publishing state. Each field then needs separate decisions for read, search, write, export, and publish. Tenant is a further condition: a bank group may share a platform while keeping academy content, learner records, and policy drafts strictly segregated by legal entity or business unit.

Search deserves special treatment. Omitting a secret field from a response is not sufficient if a query can still return the course because the secret text matched. The result may reveal that a phrase, name, or answer exists. Search indexing is therefore its own permission boundary, not an implementation detail behind read access.

Two October releases make the risk concrete

On October 13, 2026, the Notion 3.8 release introduced database column permissions that let owners control which properties each person or agent can view or edit. This is a useful model for LMS field-level permissions: an author might edit lesson copy without seeing restricted learner data, while a publishing agent can access approved publishing fields without reading answer keys.

The failure mode is even clearer in Strapi. Its October 14, 2026 release roundup explains that private fields had been hidden from API responses but could still match `_q` search queries. New private fields are now marked non-searchable, but existing private fields require a manual `searchable: false` setting or a resave. The lesson is not that either platform is inherently unsafe. It is that visibility, searchability, and historic configuration can diverge.

The same Strapi update also notes that media MCP tools check the permissions assigned to the user or token, while audit-log export requires a separate export permission in addition to read access. Those are sound patterns. An agent must receive only the tools and actions needed for a bounded job, and export must never be assumed from the ability to view.

A defensible academy access matrix

For a bank or fintech academy, define access as role × tenant × field × operation. A practical baseline looks like this.

• Learner — Read and search published learner-facing content within the assigned tenant. No draft access, answer-key access, writes, exports, or publishing.
• Reviewer — Read draft learning copy, hints, rationales, and answer keys for assigned courses. Write review decisions and comments. No bulk export or publication.
• Author — Read and write assigned content fields and approved source material. No access to learner PII unless the workflow requires it. No direct production publish.
• Publishing agent — Read only approved, publishable fields. Write delivery metadata and publish to a defined tenant and channel. Cannot search or export answer keys, reviewer notes, or PII.
• Translator — Read source strings that are explicitly marked translatable. Write localized variants. Cannot see answer keys, policy drafts, learner records, or other tenants.
• Auditor — Read access logs, configuration, version history, and selected evidence. Export only approved audit packages. No editing or publishing.

The matrix should be enforced consistently in the authoring interface, API, search index, export jobs, MCP tools, background automations, and analytics pipelines. A permission rule that exists in only one layer is a convention, not a control.

Negative tests reveal the real boundary

Role testing should not end with a successful login and a visible-page check. Create adversarial test cases that ask the system to break its own model.

• Search for the exact text of a hidden answer key and confirm there is no match, snippet, count, suggestion, or ranking signal.
• Ask a publishing agent to list answers, export a course workspace, or retrieve reviewer rationale and confirm each request fails.
• Attempt a cross-tenant lookup using a course ID, learner identifier, asset URL, and semantic search query.
• Verify that a reviewer can approve content without gaining bulk-export rights.
• Remove a role or revoke an agent token, then confirm cached tools, saved searches, and queued jobs lose access.
• Run the suite after schema changes, permission changes, index rebuilds, migrations, and agent-tool updates.

Controls for regulated learning operations

Start with an information model, not a generic permissions screen. Classify each field as learner-visible, confidential learning integrity, restricted personal data, internal policy draft, or publishable operational content. Assign an owner, retention rule, searchable flag, export rule, and agent eligibility to every class. Then default new fields to deny for search, export, and agent retrieval until an accountable owner approves the exception.

For client academies, App-Learning can implement this as a capability across content models, role design, publishing workflows, and release tests. The goal is not to slow authors down. It is to let authors work in one practical workspace without making every co-located field readable to every person, service, or model.

Security boundaries need operational limits

Field-level access control does not replace identity governance, encryption, data-loss prevention, vendor review, or human approval for high-impact policy publishing. It also cannot repair content already copied into uncontrolled documents, chat histories, local exports, or model prompts. Banks should map those downstream paths and set retention, logging, and incident processes around them.

Still, the answer key is an effective design test. If a platform cannot prevent a learner, translator, search index, export job, or AI agent from discovering it when they do not need it, then the learning system does not yet have a reliable permission model. In an AI-ready academy, access must be specific enough to protect the field, narrow enough to constrain the operation, and testable enough to prove the boundary holds.