How to put an AI assistant to work running your course — and how to keep it from doing anything you did not authorise.
Written for a colleague who teaches aerospace safety, and structured the way he teaches it: policy, risk management, assurance, promotion.
Claude Code is not a chat window. It is a program that runs on your own computer, in the terminal, with permission to read your files, run commands, and call services you connect it to. You type an instruction in ordinary English, it proposes what it is about to do, and it waits for you to approve.
The practical consequence for a course is this. Instead of downloading a set of readings, renaming them, summarising them and posting an announcement by hand, you type one sentence describing the outcome. It does the steps and shows you the result before anything becomes visible to a student.
What it is not: it is not connected to your university systems out of the box, it does not act while you are away unless you deliberately build that, and it is not a grader. Everything in this guide assumes you stay the decision maker.
You teach safety management, so this is written as a safety case rather than a manual. Chapter 2 is the policy decision you make before installing anything. Chapter 5 is the hazard analysis. Chapter 7 is assurance. If you only read two chapters, read those two.
Before installing anything, settle three questions. They take five minutes and they determine every technical choice later.
You are. An assistant acting under your account is you, as far as the system and your students are concerned. Nothing in this guide changes that, and no configuration will. Treat the setup the way you would treat handing someone your faculty credentials, because functionally that is what a Canvas token is.
The useful split is between work that is reversible and invisible and work that is irreversible or student-facing. Reading your files, summarising a chapter, drafting an announcement, building a spreadsheet, reorganising a folder — all reversible, all invisible. Posting that announcement, messaging a student, changing a grade, deleting a file in Canvas — not reversible, and visible to people who did not consent to being part of an experiment.
That single rule is worth more than every technical control in this guide. It is also easy to hold, because the tool asks permission by default.
Connecting an assistant to the university's learning system is a question for your IT department, not just for you. Ask them before you wire anything up. In the specific case of Embry-Riddle's Canvas, personal access tokens are available to users — the option is present under user settings — but availability is not the same as approval. One email to IT protects you, and a safety professional asking permission first is a good look.
Two minutes, one command. You will need a Claude Pro, Max, Team or Enterprise subscription — the free tier does not include Claude Code. Sign up first at claude.com/pricing.
Open the Terminal application (press ⌘Space, type terminal, press return) and paste this:
curl -fsSL https://claude.ai/install.sh | bash
Open PowerShell and paste this:
irm https://claude.ai/install.ps1 | iex
It installs as a self-contained program. You do not need to install Node.js, Python or anything else first, and it keeps itself up to date.
Make a folder for your course work, move into it, and start:
mkdir ~/AVSF210 cd ~/AVSF210 claude
The first run opens a browser window to sign in. After that it remembers you.
Claude Code can only read and edit files inside the folder you started it in, and folders beneath it. Starting inside a dedicated course folder is itself a safety control: it cannot wander into your tax returns. Make a new folder per course and start it there.
This is the part that makes the whole thing safe to use, so it is worth five minutes of attention.
Every time it wants to change a file or run a command, it stops and asks. You see exactly what it proposes, and you approve or refuse. You can also say "yes, and stop asking me about this particular thing", which is how the friction falls away over the first week without you losing control of the things that matter.
There are several modes, switched with ShiftTab during a session:
| Mode | What it does | Use it when |
|---|---|---|
| Manual | Asks before every edit and every command. | Your first fortnight. Start here. |
| Plan | Reads and investigates but changes nothing until you approve a written plan. | Anything large, or anything you do not yet trust. |
| Accept edits | Stops asking about file edits; still asks about commands. | Once you are comfortable and reviewing afterwards. |
| Auto | Handles most things itself, stopping for genuinely risky actions. | Routine work you have already seen it do correctly. |
There is a mode that turns the asking off entirely. It exists for disposable test machines. On the computer you teach from, connected to your Canvas account, do not use it. There is no situation in this guide that needs it.
You can also write standing rules — always allow this, never allow that. Type /permissions inside a session to manage them, or edit ~/.claude/settings.json directly. A sensible starting rule for a course folder is to forbid anything destructive outright:
{
"permissions": {
"defaultMode": "default",
"deny": [
"Bash(rm -rf *)"
]
}
}
Canvas has an interface that programs can use, and it is opened with a personal access token — a long password that identifies you to it.
A Canvas token carries your entire permission set. There is no way to issue one that can read announcements but not change grades. Whatever you can do in Canvas, anything holding that token can do — post to every student, alter marks, delete material. This is the central hazard of the whole setup, and Chapter 6 is about controlling it.
Never paste the token into a file that lives in your course folder, and never into a message. Put it in a hidden file in your home directory and lock the permissions:
echo 'CANVAS_TOKEN=paste_your_token_here' > ~/.canvas-secret chmod 600 ~/.canvas-secret
Then tell Claude, in plain words, that the token lives in that file and that it should read it from there rather than printing it. It will write scripts that reference the file instead of embedding the secret.
The simpler route, and the one to start with, is to have Claude write small scripts that call Canvas directly. You ask for what you want, it writes the script, you watch it run. Nothing extra to install.
The more polished route is an MCP server — a standing connector that gives Claude a set of Canvas actions as native tools, added with claude mcp add. Claude Code does not ship with a Canvas connector, so this means finding or building one. Worth doing eventually. Not worth doing in week one.
Here is the analysis, in the form you would expect of a student. Each hazard is a present condition, not an outcome, and each control names who does what and how you would know it worked.
Consequence: anything that obtains it can post to every student, alter grades or delete course material under your name.
Controls. Set an expiry date at generation, ending with the term. Keep it in a permission-locked file outside the working folder. Never transmit it. Delete it from Approved Integrations the day the term ends. Verification: open Approved Integrations once a month and confirm the list contains only what you expect.
Consequence: a wrong, premature or malformed announcement reaches the whole class and cannot be unsent.
Controls. Run in Manual or Plan mode. Require that anything student-facing is produced as a draft file you open and read, with posting as a separate instruction you give afterwards. Verification: the draft exists on disk and you approved the posting step. This is the control that matters most, and it costs you about fifteen seconds per announcement.
Consequence: a confident summary misstates a regulation, a date or a requirement, and students act on it.
Controls. Ask for the source alongside the claim, and have it quote rather than paraphrase where precision matters. Treat anything factual as a draft by a capable but unverified assistant, because that is exactly what it is. Verification: spot-check every factual claim that a student could act on. You already do this with teaching assistants.
Consequence: names, grades or submissions leave the systems your institution controls.
Controls. Do not ask it to process identifiable student data in the first instance. Work with aggregates and anonymised extracts. If you genuinely need per-student work, ask IT first, and say plainly what leaves the machine. Verification: before any task touching student records, ask yourself what would appear in a screenshot of it.
Consequence: after a fortnight of approving everything, you approve without reading, and the human check becomes ceremonial.
Controls. Grant standing permission only for reversible, invisible actions, and keep asking for the irreversible ones however tedious it feels. Verification: if you cannot remember the last time you refused something, the control has already decayed.
With these controls in place the residual risk is that a draft you approved was wrong and you did not notice. That is the same risk you carry with any assistant, and it is managed the same way: read it before it goes out.
Instructions are ordinary sentences. Say the outcome, not the steps. These are graded from entirely safe to student-facing, and the later ones assume the draft-then-approve pattern from Chapter 6.
Read every slide deck in this folder and build me a single table: week, topic, the concepts introduced, and which textbook chapter each maps to. Save it as a spreadsheet.
Compare last year's Week 4 deck with this year's and tell me exactly what changed, so I know what to re-record.
From the accident-causation deck, draft ten multiple-choice questions at the level of a second-year undergraduate. For each, give the answer and one sentence on why the wrong options are tempting. Save it as a document I can edit.
Take my learning outcomes for Week 5 and tell me which ones the current assessment does not actually measure.
Using my Canvas token, list every assignment in AVSF 210 with its due date and how many students have submitted. Just show me a table.
Tell me which students have not opened the Week 5 materials. Use initials rather than names.
First:
Draft an announcement for AVSF 210 telling students the Week 5 packet is posted, what it covers, and that it is due Sunday at 11:59pm. My usual tone: direct, no exclamation marks. Save it as a file for me to read. Do not post it.
Then, after you have read it and edited it:
Post that announcement to AVSF 210 now.
Two instructions instead of one is the entire difference between an assistant that drafts and an assistant that broadcasts. Keep them separate even when you are in a hurry. Especially when you are in a hurry.
Build me a single web page I can open each morning: every AVSF 210 deadline in the next fortnight, submission counts, and anything overdue. Pull from Canvas, save it as one file on my computer, and tell me how to refresh it.
Ask for a single self-contained file. It opens in a browser, needs no server, and nobody else can reach it.
Controls that nobody checks are not controls. Four ways to check, in ascending order of effort.
In Manual mode you see each proposed action before it happens. Read them. When a command appears that you do not understand, ask what it does before approving — that question is always answered.
Anything student-facing exists as a file before it exists as an announcement. Open it in your normal editor. This is your real inspection point.
Every session is written to disk under ~/.claude/projects/. It records what you asked, what it did and what came back. If you ever need to reconstruct what happened on a particular afternoon, it is there. For a safety-minded department this is your audit trail, and it exists without you doing anything.
Esc stops it mid-action. /rewind restores your files to an earlier point in the session. Both are worth practising once on something unimportant, so that the first time you need them is not the first time you use them.
Type /clear between unrelated jobs. Each task then starts clean, which makes the assistant noticeably sharper and the transcript far easier to read later.
Canvas, Account → Settings → Approved Integrations, find it, delete it. It stops working immediately. Generate a new one when you are ready. This takes about thirty seconds and there is no reason to hesitate — a token is trivially replaceable, which is exactly why you should revoke one the moment you are unsure.
Delete it in Canvas as you normally would, then post a short correction. Then look at which control failed. It will almost always be that a draft step was skipped.
/rewind in the same session. If the session is closed, the transcript under ~/.claude/projects/ will tell you exactly what was changed.
Tell it so, directly, and give it the source. It will correct and carry on. Consider putting the correction into a short file called CLAUDE.md in your course folder — it reads that at the start of every session. Keep it under about fifty lines; a long one gets diluted.
| To do this | Type this |
|---|---|
| Start, in your course folder | cd ~/AVSF210 then claude |
| Change how much it asks | ShiftTab |
| Stop it, right now | Esc |
| Undo file changes | /rewind |
| Start a fresh task | /clear |
| Manage standing permissions | /permissions |
| See what a session has cost | /usage |
| Revoke Canvas access | Canvas → Account → Settings → Approved Integrations → delete |
If you stop after step two you will still have saved yourself hours, with nothing connected and nothing at risk. That is a perfectly good place to stop.