Investigating an integrity concern

Signals that warrant a closer look

The recording panel shows flags — moments outside the typical pattern of writing-by-hand. A flag says "look at this." Not "this happened."

Categories, enumerated in the review settings panel:

• large-paste — paste over the prose-length threshold
• tab-paste — paste after the student switched tabs
• off-page-paste — paste while the editor wasn't visible
• straight-cursor — keystrokes with no naturalistic micro-cursor drift
• implausible-press — timings too fast for human fingers
• no-backspace — long passages with zero corrections, against the author's baseline
• typing-burst — sustained high characters-per-second
• style-shift — voice fingerprint drifting paragraph-to-paragraph
• programmatic-input — characters bypassing the keyboard
• external-edit — body delta on reload not produced by this session
• authorship-anomaly — session reads unlike the author's prior work

Severity (low / medium / high) is about how unambiguous the signal is, not how bad the behavior. A high-severity paste means the paste happened. Not that it was dishonest.

Paste analysis — and its limits large-paste

Pastes are the most common flag and the most misread.

The recording stores three fields per paste: timestamp, offset, length. Clipboard content is never captured — see the privacy doc.

Clicking a paste flag shows a context excerpt — prose around the position in the final document. Two caveats:

• Positions drift. Edits around the paste shift the span. The dashboard snaps to the nearest sentence boundary; it's an approximation.
• The highlight shows what's there now, not what was on the clipboard. A paste rewritten word-by-word shows the rewrite.

Large pastes have legitimate uses every day: quoting a primary source, restoring from a backup, pasting an earlier draft. The paste flag asks "what was this paste?" The conversation answers it.

Baseline divergence authorship-anomaly

The strongest signal isn't any single paste — it's continuity. Red Stet builds a per-student baseline: typing rhythm, pause distribution, correction rate, sentence-length variance, vocabulary breadth. Each session scores 0–100.

The baseline panel sits at the top of the review. Three states:

• Matches author baseline (75–100, sage) — reads like the student's other work.
• Some divergence (50–74, blue-grey) — a few metrics drifted.
• Sharp divergence (below 50, red) — multiple core metrics moved together.

One signal, not a verdict. Legitimate divergence: phone, injured wrist, fatigue, dictation, borrowed keyboard, timed test, a student who just leveled up. The score says unusual; the conversation says why.

Cross-document comparison

The baseline compares to the cumulative average. Sometimes the better question is "this session vs. that one three weeks ago — the one I know was theirs."

From the composition fingerprint panel: "Compare against another document by this author →". The picker shows every other document by this student with a recording. Pick one and the dashboard renders side-by-side: overlaid rhythm histograms, drift table, match score.

Use when you have a reference point — a poem read aloud in class, a free-write you watched, last week's draft they revised live. Divergence from a specific session plus the aggregate hardens the signal.

Most useful as exonerating evidence. An anxious student can usually point you to a doc they remember writing cleanly — the match score carries weight.

What the recording can prove — and what it can't

Precision protects everyone in the conversation.

Can prove process

• A paste happened at a time and position.
• The editor wasn't visible when the paste landed.
• Typing arrived faster than human-plausible for a sustained run.
• A body change appeared on reload without keystroke events.
• This session's rhythm is statistically unlike the author's others — as a probability.

Cannot prove intent

• What was on the clipboard. Never recorded.
• Whether a paste came from an AI tool vs. a primary source, notes, or a textbook.
• That divergence means cheating. Phones, fatigue, injuries, dictation, and growth cause it too.
• What the student knew, intended, or understood. Conversation, not measurement.

That distinction makes the recording conversation infrastructure. Point at a paste at 14:02 and ask "what was this?" — both of you on the same evidence.

Holding the conversation with the student

Show, ask, listen.

Show

Open the recording together. Same dashboard you read — flags, timestamps, paste range, baseline panel. Most defensive postures dissolve once they see this is process evidence, not a verdict.

Ask

Open, factual questions tied to specific moments:

"At 14:02 the recording shows a paste of about four sentences. Walk me through what that was."

"The baseline panel says this session's rhythm is unlike your other writing. Tell me about the writing conditions."

Avoid yes/no and leading questions. "You used AI on this, didn't you?" closes the conversation; "What was this paste?" opens it.

Listen

Three patterns. Plausible and corroborated ("a quote from chapter 4, here's the page") — non-issue. Plausible but not corroborated ("from my notes app, I can show you") — ask to see them. Implausible or contradicted ("I typed every word" when the recording shows a 400-character paste) — name it calmly: "the recording shows a paste here, so I want to make sure we're looking at the same thing."

The student may revise their account. Update your understanding; don't punish the revision.

The in-app notify-student flow Send notification

Every flag row has a Notify student button — for asking when the student isn't in front of you. The composer opens with an optional reason textarea.

What lands on the student's side:

• A bell on every signed-in device (kind: flag-decision-notified)
• An email mirror with category, decision, and note verbatim
• A "Review the flag" card on the assignment info panel with a File an appeal button

Good for one targeted question, off-the-spot responses, a written record, resolving low-severity flags without face-to-face.

Not for hard conversations. Sharp baseline divergence and serious flag clusters need in-person. Clarifying questions, not consequences.

The student appeal — reading and resolving Appeals

The student-side composer is a 4,000-character textarea. Submission lands as an open row on the appeals table and pushes flag-appeal-submitted to every staff member with Grade submissions (owner, co-teachers, TAs by default).

Open the submission's review surface and scroll to Student appeals under the rubric scorer. Each row shows:

• Flag category and timestamp
• When filed
• Student's text, verbatim
• Status pill: Open (red), Acknowledged (blue-grey), Resolved (sage)

Two actions per open appeal:

• Acknowledge — silent read receipt. Status flips to acknowledged; no notification. For when you've read it but want to think.
• Resolve… — closes the appeal with an optional note. Pair with a decision change (Confirmed → Non-issue) when the appeal changes your read.

Multiple appeals stack on the same submission (different flags, or the same flag re-appealed after return-for-revision). Sub-card sorts open first, then acknowledged, then resolved — newest-first within each.

Escalating to admin or parent — and the verifier link

Bringing in a department chair, dean, counselor, or parent — the question is "how do they see what happened without taking your word for it."

The verifier link. Export a .red.md bundle — document plus full provenance chain — and share through the standalone verifier. Public URL, no account. The recipient sees:

• Final document text
• Full event timeline, replayable
• Flags with severity bands
• Composition fingerprint and chain-integrity badge

Shared ground — same evidence you have, not your interpretation.

Useful for parents too. Sharing the link lets the student show the recording at home — most find it reads less damning than they feared.

Documenting the outcome for your own records

Write it down. For future you. Three weeks later, after forty more submissions, you won't remember the nuance.

Capture in your gradebook or notes:

• Date and assignment — slug + title
• Flags — categories, severity, baseline score
• What the student said — two or three lines, paraphrased
• Corroborating evidence — screenshot, link, whatever you asked for
• Resolution — confirmed, non-issue, or pending
• Action — none, revision, partial credit, referral

The decision row (Confirmed / Non-issue / Pending) rides into the LMS gradebook comment on passback — "Provenance review: 2 confirmed · 1 non-issue · 0 pending. Strong analysis." Decisions persist server-side.

Mark every reviewed flag even when the resolution is "non-issue." Pending forever makes future you (or a sub) think the work was never reviewed.

When you decide it's not an issue — handling it gracefully

Most resolutions are nothing happened. The paste was a quote. The burst was flow. The baseline divergence was a phone-typing session. Students don't just need to be cleared — they need to feel cleared.

Practices that help:

• Mark the flag non-issue so the record reflects your decision.
• Tell the student in the same thread. "Thanks — that clears it up, marking as resolved" lands better than silence.
• Don't apologize for asking. Asking is the workflow. Do thank the student for engaging.
• Don't bring it up in assignment feedback unless directly relevant. Closed is closed.

Frequently asking and frequently resolving non-issue for the same student is a signal to tune your review settings — not that they're borderline. Some styles trip more flags. Raise the noise floor.

A healthy classroom isn't zero flags. It's flags appearing, getting read, getting asked about when warranted, and mostly resolving as unremarkable.

Tuning your review settings Review settings

After a few investigations you'll find some categories generate more noise than they're worth. The per-teacher Review settings panel lets you:

• Set a minimum severity (low / medium / high). Flags below drop out of the review list. Events stay recorded.
• Disable specific categories. straight-cursor is the usual first target — false-positive heavy in trackpad classrooms.
• Bulk-dismiss low-information clusters when the banner offers it ("Mark 8 cursor flags as non-issue").

Personal preferences. Don't change recording, don't affect other teachers.

Starting place: minimum severity medium, straight-cursor off, everything else on. Adjust as your students' rhythm gets familiar.

Classroom Provenance policy classroom-edit · Provenance policy

Review settings are your personal filter. Classroom Provenance policy lives on one classroom and applies to every assignment in it. Owner sets it; co-teachers and TAs with "Edit class details" can adjust. Students never see it.

Three controls, layered on each teacher's personal review settings:

Per-category surfacing

Three dispositions per category:

• Auto — default. Flag surfaces inline.
• Manual — flag moves under a Suppressed by policy disclosure. Still there when you want it. For categories that occasionally produce useful evidence but aren't worth scanning every time.
• Off — flag hidden from the review surface. Count appears in the disclosure; individual flags don't. Recording still captures every event. Exports include off-by-policy events.

Severity floor

One global threshold across every category. Medium mutes every low-severity flag. Events still recorded.

Suggested first-pass decision

Pre-highlight a decision pill ("Non issue" or "Confirmed issue") on each category. The teacher sees the highlight but clicks to commit — suggestions never auto-persist. Encodes known patterns ("style-shift in this AP Lit class is usually quotes") without forcing dismissal.

Related

→ Reading the provenance recording — the scrubber, the flag list, what each visual element means.

→ Talking to students about the recording — the day-one introduction. The stance you set shapes every investigation later.

→ What's recorded, what isn't — privacy posture. The doc to send a parent who asks.

→ Back to the help library.

Worked an investigation that didn't fit this workflow? Email feedback.