What I mean by catalyst, not crutch
I teach and support e-learning in the Faculty of Computing and Informatics at Makerere University Business School (MUBS). In the last two years, generative AI walked into every take-home task that still looked like a 2015 essay brief. Students did not invent that pressure. We did, by asking for polished prose that a model can draft in seconds.
On 14 August 2026, at the Uganda Universities Quality Assurance Forum (UUQAF) Campus Convention hosted by Kampala University, Dr. Vincent Ssembatya, Director of Quality Assurance and Accreditation at the National Council for Higher Education (NCHE), put the challenge plainly. AI should not be treated only as a threat. Universities need to understand it and incorporate it responsibly into teaching and assessment, and they must strengthen assessment so students demonstrate their own knowledge, skills, and competencies. Kampala University’s public report of that convention is here: Universities urged to embrace AI while strengthening quality assurance and academic integrity.
That framing matches what I see in the lab. When assessment rewards a finished essay, AI becomes a crutch. When assessment rewards a live host, a log trail, and a short viva, AI can become a catalyst for better questions, clearer checklists, and honest competence. This post is a concrete redesign for a computing module, not a sermon about “the future of education.”
Policy context without the fog
NCHE’s Competence-Based Education (CBE) direction raises the stakes. From the 2027/2028 academic year, higher education institutions are expected to admit first-year students only to programmes aligned with a CBE framework. NCHE documented that direction in its January 2026 consultative meeting on CBE reforms. Assessment sits among the nine focus areas in the draft minimum standards presented there. Related reading on this site: The 2027 NCHE mandate and what CBE means for computing faculties.
Separately, at MUBS itself, Principal Prof. Moses Muhwezi has publicly urged universities to introduce AI programmes and systems across courses so students treat AI as a working tool, not a mystery. New Vision reported that message from the World Tourism Day student conference at MUBS in September 2026: Universities challenged to introduce AI programmes. Tool fluency without assessment redesign still produces graduates who can prompt but cannot prove skill. We need both.
The failure mode I keep seeing
Take a familiar Information Security or Unix fundamentals module. The old coursework brief looks serious: “Discuss firewall best practices for a campus network (1,500 words). Use at least five scholarly sources.” A strong student can still write an honest essay. A rushed student can paste the brief into a generative model, swap a few phrases, and submit before midnight. Turnitin-style detectors chase style. They do not prove the student ever opened ufw, read an auth.log line, or explained why root SSH login was disabled.
In consulting sessions with programme teams, I ask one question: if the student cannot sit next to the machine and show the control, what did the essay grade buy us? Often the honest answer is “a mark that looks fair on a spreadsheet.” That is the crutch. CBE and AI together make that pattern expensive. Industry partners will not hire an essay. They will ask for a hardened baseline, a ticket trail, and a calm explanation under questions.
Concrete redesign: Information Security with Unix evidence
Here is a redesign I use when advising or co-teaching applied computing modules. Keep the credit load. Change the evidence.
Outcome statements that a lab can observe
Outcome A: Configure a baseline-secure Linux host (users, SSH policy, host firewall, basic audit trail) and demonstrate it live.
Outcome B: Map three campus-relevant threats to concrete controls, and justify each control in plain language during a viva.
Outcome C: Produce an annotated evidence pack (config dump plus log excerpts) that another assessor can re-check without trusting the student’s memory.
Outcome D (optional stretch): Critique an AI-generated hardening checklist, mark what is wrong for our lab VLAN, and fix it before the demo.
Notice Outcome D does not ban AI. It forces the student to argue with the model. That is literacy, not prohibition.
What the student must submit
Annotated config dump:
sshd_configrelevant lines, user list, firewall rules, with comments in their own words.Log evidence: short excerpts from
journalctlorauth.logthat match the story they tell (failed logins after a rule change, successful restricted SSH, and so on).Observed lab checklist: fifteen minutes, assessor present, tick boxes for “show,” not “claim.”
Eight-minute viva: why this rule, what breaks if we remove it, what would you change under higher traffic?
Allowed AI use must be declared on a one-line cover note: drafting a checklist, explaining a man page, suggesting test commands. Invented logs and skipped vivas are academic integrity failures. That boundary is clearer than a vague “do not use ChatGPT” poster.
Illustrative grade mix
Exact weights belong in your faculty policy. For a pilot module, a workable mix is: observed lab 40%, evidence pack 25%, viva 25%, short concept quiz 10%. The written quiz still exists. It no longer carries the whole story. Students who only prompt well still fail the live portion. Students who are nervous writers but solid operators get a fairer path, which is also a CBE goal.
Why viva + logs beat detector wars
Detector software races model updates. A viva asks for presence. Log evidence asks for a trail you can reperformance-check, the same habit auditors use when they recompute a figure instead of trusting a verbal claim. If you teach or learn audit thinking, start with Part 1: what an IT and IS audit actually is. The parallel is useful: assessment that cannot be evidenced is theatre.
In one MUBS lab week, I replaced a take-home “write about privilege escalation” task with a short scenario: a guest account left on a project VM, sudo open wider than needed, and noisy failed SSH attempts in the log. Students had to remediate, capture before/after lines, and answer three viva questions. The room got quieter. The quality of conversation rose. We spent less time arguing about originality percentages and more time on whether the control actually worked.
Unix lab viva script you can steal
Keep the viva short so large cohorts stay feasible. Sample questions:
Show me the line that blocks password root login. What risk remains if keys are poorly managed?
Point to the firewall rule that allows your admin subnet. How would you prove it without trusting the GUI?
Your log shows repeated failures from one address. Containment first or investigation first, and why?
You used an AI suggestion for a rule. Which part did you reject for this lab VLAN?
Score with a rubric that separates “ran the command” from “can explain the risk.” That split stops theatrical demos where a student follows a printed sheet without understanding.
What about essays that still matter?
Not every outcome needs a rack of machines. Design trade-off memos, threat models, and incident timelines still matter. Redesign them so AI cannot finish the job alone:
Require a campus-specific constraint (our VLAN map, our helpdesk ticket style, our attendance policy).
Require an appendix of primary evidence (screenshot of the ticket, lab capture, interview notes with a named peer).
Add a five-minute defence slot for a sample of submissions, not only flagged ones.
Ask students to attach the AI prompt they used, if any, and a paragraph on what they changed.
Process visibility is the catalyst. Hidden prompting is the crutch.
Staff load, class size, and honesty
Vivas scare timetable offices. Fair. You cannot run forty-minute orals for every student every week. You can run eight-minute stations during scheduled lab blocks, sample randomly for take-home artefacts, and use peer first-pass checklists before the assessor sees the machine. Teaching assistants can hold the checklist while the lecturer calibrates borderline cases. That is faculty training work under CBE, not optional charity.
Infrastructure still bites. If eight machines boot for forty students, viva design collapses into queue chaos. Pair this redesign with a sober look at labs, power, and bandwidth: Closing the infrastructure gap for AI and CBE. Assessment reform without working labs is policy theatre.
Governance that supports the classroom
Uganda does not yet hand every university a single national AI classroom statute. Institutions still need internal rules on acceptable use, disclosure, privacy, and integrity. Related: Why Ugandan universities need internal AI governance policies now. For assessment teams, the practical minimum is: declare allowed uses per task, require disclosure, ban fabricated evidence, and train markers to ask for demonstration when prose looks too smooth for the student’s other work.
A one-semester pilot plan
Pick one module (Information Security or Unix lab is enough).
Rewrite four outcomes as observable verbs.
Replace one major essay with viva + log evidence.
Publish the AI disclosure line on the brief.
Calibrate two assessors on three sample vivas.
Collect student time-on-task and failure modes.
Report to your CBET committee with artefacts, not slogans.
That sequence is how AI stops being a panic topic and starts shaping better competence evidence. Dr. Ssembatya’s UUQAF challenge was not “buy more detectors.” It was strengthen assessment so students show what they know. In a MUBS computing lab, that looks like a live host, a log trail, and a short defence. Catalyst, not crutch.