A Login Is Not a Learner

A learning platform can record a name, a login, a completed activity and a submitted assignment. None of these facts, by itself, proves that the named person participated, learned or can perform the assessed capability. Generative AI intensifies an old distance-education problem because one operator can now create convincing applications, messages and coursework at scale.

The answer is not permanent suspicion or indiscriminate surveillance. Institutions need two related but distinct forms of assurance. Identity assurance asks whether the person is who they claim to be. Learning assurance asks whether that person can understand, judge, perform and transfer the intended capability. Strong identity checks cannot rescue a weak assessment, and a persuasive assignment cannot establish identity.

A humane system therefore connects lawful enrolment, proportionate verification, accessible participation, purposeful human relationship, evidence of the learning process, independent performance, contextual transfer, correction and appeal. Its purpose is to protect real learners and public trust—not to turn every learner into a biometric risk score.

The newest global agenda names a problem education can no longer ignore

UNESCO's Digital Learning Week opens on 8 September 2026 under the theme Education in the age of AI: Facts, Frictions and Frontiers. Its official programme framing identifies synthetic research and 'ghost learners' as challenges to established assumptions about evidence, participation and presence. It places them alongside agentic AI, synthetic knowledge, public-interest AI, digital sovereignty and analogue or community-led alternatives.

At the time of publication, the event had not begun and no conference declaration or evaluated intervention existed. This is a verified agenda signal, not evidence that governments or institutions have adopted a solution. Its importance lies in the question it places before educators: when systems can manufacture the visible traces of participation, what counts as credible evidence that a real person has learned?

For the Global South, that question must be joined to another. What forms of identity and learning assurance protect institutions without excluding people who have unstable connectivity, shared devices, changed names, limited documents, disabilities or long travel distances? A solution that blocks fraud by blocking legitimate learners is not educational success.

Official evidence shows how identity, participation and assessment can all be imitated

A 24 July alert from the United States Financial Crimes Enforcement Network, prepared with the Department of Education Inspector General and the FBI, describes fraud rings using stolen or fabricated identities to enrol in institutions and obtain student-aid refunds. It says AI may be used to generate fraudulent documents and that chatbots may complete coursework so false enrolments remain active long enough to receive funds. Real students can lose class places, while identity-theft victims—including minors—may face debt or reduced eligibility for aid.

The alert also reports that the Department of Education said it prevented more than one billion US dollars in federal student-aid fraud during 2025. That figure concerns all prevented federal student-aid fraud described by the department, not ghost students alone. The alert combines regulatory, law-enforcement and open-source information; it does not estimate the prevalence of this problem in Africa or show that every online institution faces the same risk.

The mechanism is nevertheless relevant beyond one financial-aid system. If enrolment, messages, coursework and apparent attendance can be generated, institutions cannot treat platform events as direct evidence of personhood or competence. They must verify at the points where identity, money, certification and public responsibility become consequential.

Identity assurance and learning assurance answer different questions

Identity assurance concerns the relationship between a person, claimed attributes and the credential used to access a system. Learning assurance concerns the validity of the inference made from educational evidence. It asks whether the evidence supports a defensible judgement that the learner achieved the stated outcome.

These tasks should not be collapsed. A verified national identity does not prove that its holder wrote an essay, interpreted a text or performed a ministry task. Continuous webcam monitoring may collect large amounts of intimate data without establishing the quality of reasoning. Conversely, a live oral defence may strongly support authorship and understanding while being an unsuitable method for proving civil identity.

Good design selects the least intrusive method adequate to each risk. Low-stakes formative learning may require an ordinary authenticated account and relational familiarity. Admission, payment, certification and high-stakes assessment may justify stronger checks, but institutions should document why each measure is necessary, what information it collects and how errors are remedied.

Standards require proportionality, privacy and usable alternatives

NIST's current Digital Identity Guidelines distinguish identity proofing, authentication and federation, and match assurance levels to risk. They require attention to fraud resistance while also emphasising privacy, usability, customer experience and data minimisation. The guidance is written for United States government systems; it is a useful technical reference, not Kenyan law or a ready-made education policy.

The World Bank-supported Principles on Identification for Sustainable Development add inclusion, non-discrimination, privacy by design, security, accountability and independent oversight. Their central insight is that identity enables access to rights and services only when the system itself does not become a new barrier.

Kenya's Office of the Data Protection Commissioner has issued education-sector guidance explaining institutions' obligations when processing personal data. This matters whenever a school or college proposes facial recognition, voice analysis, keystroke patterns, identity documents or behavioural monitoring. Being technologically possible does not make collection necessary, proportionate or lawful.

Biometrics can reduce one risk while creating several others

A face, voice or fingerprint is not merely another password. If a password is compromised, it can be replaced; a body cannot. Biometric systems may also produce false non-matches, impose particular burdens on some users, reveal sensitive information and encourage institutions to retain data beyond the original educational purpose.

The correct question is not whether biometrics are modern. It is whether the specific risk and legal basis justify the specific processing, whether a less intrusive method could work, whether performance has been evaluated across affected groups and whether a credible non-biometric route exists. Accessibility accommodation must be designed before deployment, not negotiated after a learner is locked out.

Institutions should also resist function creep. Information gathered to authenticate an examination should not silently become attendance monitoring, behavioural profiling, disciplinary evidence, marketing data or a training set for another system. Purpose, retention, access, deletion and independent complaint routes need to be explicit.

The research supports acceptability work, not technological certainty

A mixed-method study involving 328 students across European higher-education institutions examined an adaptive trust-based e-authentication system for online assessment. A related study involving 267 students with special educational needs and disabilities found broadly positive acceptability, while attitudes varied with gender, age, prior experience and need for adaptations more than with disability category alone.

These studies provide useful evidence about user experience with one research system. They do not prove that remote proctoring or biometric authentication is universally accurate, necessary, fair or acceptable. They predate today's generative-AI capabilities and cannot be transferred uncritically to African institutions, learners or data-protection environments.

Their continuing lesson is methodological: affected learners must be studied as users and rights-holders, not treated as obstacles to a security design. False rejection, anxiety, bandwidth use, device requirements, privacy, cost and appeal should be measured alongside fraud detection.

Learning assurance should make the learner's judgement visible

The OECD Digital Education Outlook 2026 concludes that generative AI can support learning when guided by clear teaching principles, but outsourcing tasks may improve performance without producing learning. This distinction is decisive. A polished product increasingly tells us less about who performed the intellectual work and what capability remains when the tool is absent.

Assessment should therefore gather an evidence ecology rather than depend upon one artefact. Useful elements include a problem statement, source trail, draft history, disclosure of AI's material role, feedback response, short oral explanation, observed performance, unfamiliar transfer task and opportunity for correction. Not every task needs every element; the combination should match the outcome and stakes.

An AI detector is not a substitute for this design. The educational question is not simply whether machine-generated language appears in a document. It is whether the learner used permitted support, can account for the evidence and choices, and can demonstrate the required capability independently where independence matters.

CBTE already possesses resources for proving the person behind the evidence

Competency-based theological education defines progress around demonstrated integration of knowledge, skill and character in authentic ministry context. Its published model makes mentoring and substantive interaction integral rather than optional. That creates a stronger basis for learning assurance than course completion alone because the learner becomes known through repeated, contextual performance.

This is a design framework, not automatic proof that every programme using the CBTE label is trustworthy. Mentors may be unprepared, assessments may be inconsistent and relationships may become coercive. Identity must be confirmed without turning mentors into surveillance agents, and judgements must be moderated with evidence, criteria and appeal.

A credible ministry assessment may combine the learner's written interpretation, a live explanation, mentor-observed practice, feedback from an authorised ministry setting and a revised response to an unfamiliar case. The platform coordinates this evidence; it does not become the witness that declares a person competent for ministry.

Online theological education needs real community, not simulated presence

African theological scholarship argues that online education can support spiritual and ministerial formation when learners remain active in churches and communities, engage Scripture and scholarship, practise ministry and receive faculty and mentor support. It also names connectivity, electricity and academic dishonesty as serious constraints.

This literature-based theological analysis is not a controlled outcome study, and online access does not prove formation. Its strongest contribution is to resist a false choice between digital and embodied learning. A learner may study online while being relationally present and accountable in a local context.

Pentecostal theology sharpens the distinction. A platform identity may carry a person's name; it cannot receive calling, bear fruit, participate in covenant community or exercise accountable spiritual gifts. AI can imitate religious language and complete religious tasks, but synthetic fluency is not discipleship and authenticated access is not anointing.

Digital ministry must distinguish audience traces from known people

Churches increasingly count views, responses, course completions, prayer requests and chatbot conversations. These traces can help improve communication, but they do not establish who received care, whether the person understood, whether a crisis was resolved or whether a claimed testimony is authentic.

A responsible digital-ministry pathway should identify when anonymity is protective and when identity must be established for safeguarding, payment, certification, counselling or referral. It should disclose automation, prohibit a bot from impersonating a pastor, protect personal and pastoral information, and provide a direct route to a competent human being.

The church must also beware the opposite error: demanding civil identity before allowing someone to explore faith, ask a sensitive question or attend an open service. Risk-based assurance preserves both hospitality and responsibility. Stronger identification belongs at consequential boundaries, not at every doorway.

Governance should follow the complete identity-to-outcome chain

Boards and academic leaders should require one joined record covering admission, account issuance, payments, learning activity, assessment, certification and appeals. It should state the lawful purpose, identity risk, assurance method, data processed, accessible alternative, responsible officer, suspicious-activity route, evidence of learning and conditions for human review.

Separation of duties matters. The vendor selling identity technology should not be the sole assessor of its accuracy, privacy or educational impact. Staff who approve enrolment should not be able to alter assessment evidence without trace. A learner wrongly flagged must reach a person with authority to investigate and restore access promptly.

Useful indicators include confirmed fraudulent applications, false rejections, time to resolution, legitimate learners displaced, data incidents, assessment appeals, independent performance, staff workload and total cost. A dashboard of blocked accounts can look successful while concealing exclusion, weak learning or unresolved identity theft.

A launch-day assurance compact can start small and remain rigorous

An institution beginning a digital teaching cycle does not need to introduce invasive technology on the first day. It should confirm the accountable educator, verify access through proportionate means, publish permitted and prohibited AI roles, provide a low-bandwidth support route, identify high-stakes verification points and reserve final assessment to authorised people.

During the first week, educators should look beyond login counts. They can use a short live or asynchronous introduction, a low-stakes diagnostic task, source-based discussion and direct contact with non-participating learners. The purpose is to establish genuine educational presence, discover barriers and build a baseline—not to punish people whose connectivity produces incomplete traces.

After the first assessment, the institution should review false alerts, access failures, disclosures, mentor evidence, learner questions and staff workload. Controls should be strengthened where the risk is demonstrated and relaxed where they add burden without assurance. Digital transformation becomes trustworthy through inspectable learning and correction, not through maximal data collection.

Research should test both fraud control and educational justice

African research should distinguish fraudulent identity, account sharing, contract cheating, permitted collaboration, assistive technology and AI-supported learning. Treating these as one category produces weak policy and unfair enforcement. The unit of analysis should extend from application through certification and later transfer, not stop at a detector score.

A comparative study could examine account authentication alone; authentication plus process evidence; relational verification through educators and mentors; and a complete assurance model adding independent performance, privacy protections, accessible alternatives, appeal and post-course transfer. It should include learners who are rural, disabled, displaced, document-poor or dependent on shared devices.

Outcomes should include fraudulent access detected, false rejection, completion, learning, independent capability, transfer, privacy incidents, appeal resolution, learner trust, staff workload and total cost. Qualitative work should investigate how legitimate learners experience suspicion and what forms of relational knowledge strengthen or distort assessment judgement.

A real learner should remain more important than a clean data trail

AI makes it possible to manufacture convincing educational traces. It also makes it tempting to answer that threat with continuous monitoring. Both errors reduce education to data: one fabricates the record, while the other mistakes a more intrusive record for the person.

Trustworthy education protects identity without worshipping identification. It uses technology to support access and assurance while relying on curriculum, relationship, authentic performance and accountable judgement to establish learning. It knows when a person must be identified, what a learner must demonstrate and where a human being must listen to an explanation or correct an error.

A login is not a learner. A submission is not competence. A digital profile is not a person before God or community. The task of leadership is to build systems in which real people can enter, learn, be known, demonstrate capability and obtain justice when the system gets them wrong.