LMS Platform Feature List for Founders: A Release-by-Release Blueprint

An LMS feature list becomes dangerous when every checkbox looks equally important. Course authoring, access control, assessment evidence and learner recovery form the operating core; badges, social feeds and elaborate gamification do not.

The useful question is which complete learning journey the first release must support and which exceptions staff must resolve. Features should earn priority by protecting that promise.

This guide organizes the backlog into durable product capabilities and release gates.

Identity and organization membership

Identity and organization membership is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement identity and organization membership as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for identity and organization membership before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for identity and organization membership. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for identity and organization membership. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved identity and organization membership state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover identity and organization membership from durable records

Role and permission model

Role and permission model is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement role and permission model as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for role and permission model before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for role and permission model. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for role and permission model. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved role and permission model state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover role and permission model from durable records

Course structure and versioning

Course structure and versioning is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement course structure and versioning as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for course structure and versioning before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for course structure and versioning. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for course structure and versioning. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved course structure and versioning state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover course structure and versioning from durable records

Content authoring and publishing

Content authoring and publishing is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement content authoring and publishing as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for content authoring and publishing before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for content authoring and publishing. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for content authoring and publishing. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved content authoring and publishing state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover content authoring and publishing from durable records

Checkpoint 4: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Catalogue and discovery

Catalogue and discovery is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement catalogue and discovery as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for catalogue and discovery before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for catalogue and discovery. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for catalogue and discovery. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved catalogue and discovery state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover catalogue and discovery from durable records

Enrolment and entitlements

Enrolment and entitlements is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement enrolment and entitlements as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for enrolment and entitlements before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for enrolment and entitlements. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for enrolment and entitlements. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved enrolment and entitlements state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover enrolment and entitlements from durable records

Cohort schedules and capacity

Cohort schedules and capacity is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement cohort schedules and capacity as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for cohort schedules and capacity before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for cohort schedules and capacity. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for cohort schedules and capacity. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved cohort schedules and capacity state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover cohort schedules and capacity from durable records

Live sessions and recordings

Live sessions and recordings is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement live sessions and recordings as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for live sessions and recordings before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for live sessions and recordings. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for live sessions and recordings. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved live sessions and recordings state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover live sessions and recordings from durable records

Checkpoint 8: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Assignments and submissions

Assignments and submissions is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement assignments and submissions as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for assignments and submissions before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for assignments and submissions. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for assignments and submissions. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved assignments and submissions state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover assignments and submissions from durable records

Assessments and attempts

Assessments and attempts is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement assessments and attempts as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for assessments and attempts before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for assessments and attempts. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for assessments and attempts. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved assessments and attempts state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover assessments and attempts from durable records

Feedback and grading

Feedback and grading is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement feedback and grading as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for feedback and grading before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for feedback and grading. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for feedback and grading. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved feedback and grading state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover feedback and grading from durable records

Certificates and credentials

Certificates and credentials is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement certificates and credentials as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for certificates and credentials before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for certificates and credentials. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for certificates and credentials. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved certificates and credentials state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover certificates and credentials from durable records

Checkpoint 12: reconcile the product promise with the recorded state. Support, finance, security, and delivery teams should be able to reach the same conclusion from the same identifiers without reconstructing events from chat messages or screenshots.

Learning analytics

Learning analytics is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement learning analytics as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for learning analytics before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for learning analytics. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for learning analytics. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved learning analytics state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover learning analytics from durable records

Accessibility and localization

Accessibility and localization is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement accessibility and localization as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for accessibility and localization before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for accessibility and localization. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for accessibility and localization. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved accessibility and localization state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover accessibility and localization from durable records

Administration and learner support

Administration and learner support is a distinct part of a learning-management platform serving learners, instructors and administrators. It changes what users are promised, what operators must observe, and which evidence the platform must retain when ordinary processing does not succeed.

The failure mode is concrete: teams implement administration and learner support as an isolated screen or integration, so permissions, financial consequences, downstream state and recovery behavior disagree. This is not solved by adding another screen or background job. The product has to define ownership, permitted transitions, and the evidence retained when the transition occurs.

For the first release, define the authoritative lifecycle, accountable role and customer-visible outcome for administration and learner support before adding interface detail. Write that decision as an enforceable server-side rule, not guidance that depends on a client, operator, or AI model remembering the intended boundary.

Implementation should include stable identifiers, explicit states, version checks, scoped authorization, timestamps, reason codes, correlation data, audit history and a documented recovery route for administration and learner support. Keep the public response smaller than the internal record: users need a clear outcome and recovery path, while authorized operators need correlation IDs, policy versions, timestamps, and the before-and-after state.

Validate it with a normal journey plus duplicate requests, stale clients, concurrent actions, dependency timeout, partial completion, revoked authority and operator correction for administration and learner support. Test the ordinary path, then repeat under timeout, duplicate delivery, stale state, partial failure, revoked authority, and concurrent requests. A feature is not ready when only the demonstration succeeds.

• Owner: product owner
• Release evidence: approved administration and learner support state matrix and acceptance results
• Stop condition: the team cannot explain or safely recover administration and learner support from durable records

Implementation references

Use 1EdTech LTI and record the version used for release.

Validate against 1EdTech OneRoster and record the version used for release.

Review 1EdTech Caliper and record the version used for release.

Compare with W3C WCAG 2.2 and record the version used for release.

Continue with LMS Software Development when turning this guide into scope.

Frequently asked questions

What is the minimum LMS MVP?

Identity, course versions, enrolment, delivery, assessment or completion evidence, administration and support.

Should every LMS support cohorts?

Only if scheduled group delivery is part of the learning promise.

How should course edits work?

Publish versions and preserve the context used by active learners.

Is completion the same as mastery?

No. Completion follows activity rules; mastery requires assessment evidence.

What should administrators see?

Owned exceptions, access state, delivery obligations and trustworthy reporting.

Which integrations matter first?

Only those required by the initial institution, identity, roster or content workflow.

When should certificates be issued?

After defined identity, completion and assessment conditions are satisfied.

What should be tested?

Roles, versions, enrolment, deadlines, attempts, accessibility, integrations and recovery.

Turn the plan into release evidence

A credible release connects its promise to durable state, scoped authority and recoverable operations. The team should explain ordinary journeys and important exceptions from the same records.

Keep the first scope narrow enough to rehearse. Expand only after access, money, evidence and support outcomes remain consistent under retries, failures and human mistakes.