Does anyone have any insight into whether this is expected or not....
I've created a course on my Moodle site which I then publish as an LTI tool. When I consume this course via the launch URL, the corresponding user created for me on the Moodle site is able to navigate around the entire site. Is there not a way of restricting the session to the course only?
In the old local_ltiprovider plugin there was a setting 'forcenavigation' which would be used to redirect users to the course/mod if they tried to stray off the path.
By the way, I am using Moodle 3.5.