Lockdown mode and violation limits

What lockdown mode does

With lockdown enabled, the attempt runs in fullscreen — the candidate starts it with an explicit "Start secure exam" step that enters fullscreen before the first question. Leaving the exam is treated as a violation: fullscreen exits, tab switches, and window blur episodes are logged as integrity events that evaluators later see as a reviewable timeline. Everything happens in the browser; candidates never install anything.

Lockdown always records violations. What else happens is your choice of policy: warn only keeps a visible record and banner; pause the exam locks the screen behind a "Return to fullscreen" overlay whenever the candidate leaves; auto-submit closes the attempt when a violation limit is exceeded; and flag for review marks the attempt for your team at the limit while letting the candidate finish.

The three optional caps

Violation limits apply to the auto-submit and flag-for-review policies. They are optional and independent — set any combination, or none. Candidates see a live count when they cross the line, so the limit is never a hidden tripwire.

• Max violation count — how many times the candidate may leave the exam (switching tabs or windows).
• Max seconds per leave — how long any single absence may last.
• Max total seconds away — the cumulative time allowed outside the exam across the attempt.

What candidates see

Candidates are never monitored silently. Before starting, every candidate passes a consent gate that states exactly what is monitored for the delivery, so a candidate in a locked-down attempt knows that leaving the exam is recorded before answering the first question. The secure exam then starts in fullscreen, and if the browser cannot enter fullscreen, the exam does not start with a cryptic error — the candidate sees a calm explanation.

When a limit is exceeded

What happens at the limit depends on the policy. Under auto-submit — the default — the attempt is submitted with an audit event, and the submission is verified server-side, so a tampered browser cannot fake or skip it. Under flag for review, the attempt is marked with a "requires review" event and the candidate continues to the end.

Either way, that is evidence, not a verdict: a human still reviews the attempt with the full integrity timeline as context. Nothing auto-rejects a candidate — the closure and its circumstances inform a person's decision, and the audit event keeps the record complete.

The file-picker grace period

Some items legitimately require leaving the exam surface — a file upload task opens the operating system's file picker. Using an item's own file picker has a grace period, so choosing a file to upload does not count as a violation. Candidates completing file upload tasks are not penalized for doing exactly what the item asks.