Roles & Access Map
Every School screen and action is permission-gated, so people see only what their job needs. This page maps the eight audiences to the exact permission keys that unlock their work, gives you a ready-to-apply preset per role, and explains the two guardrails — segregation of duties on grades, and restricted access to health and safeguarding records.
school (needed to reach the module
at all). Each page has its own “Enabled” toggle in the Roles editor (e.g.
school_grades), and many pages add _create / _update /
_delete children for the buttons. A few permits are restricted or
segregated and should go to specific people only. Grant them in the ERPat
Roles editor.
The eight audiences
Pick the playbook that matches a person’s job — each links to a step-by-step guide.
Takes daily section attendance and encodes → submits quarter grades on the class record.
Approves and releases grades and report cards — held separately from encoding.
Runs support cases and the confidential, audited safeguarding and health records.
Enables the module, migrates per tenant, grants permissions, configures portals and policy.
Issues visitor passes and checks visitors in and out — each scan is logged.
See their verified children’s released grades, attendance, and enrollment.
See their own released grades, attendance summary, and current enrollment.
Suggested permission presets
A practical starting point per role. Everyone gets school plus the permits below.
Tune to your school’s org chart — these are recommendations, not hard-wired roles.
| Role | Grant (in addition to school) | Notable actions unlocked |
|---|---|---|
| Registrar | school_enrollment (+create/update/delete), school_learners (+create/update/delete), school_guardians (+create/update/delete), school_academics (+create/update/delete), school_reports |
Add learners/guardians, verify links, process & approve applications, build the academic structure, run LIS validation. |
| Teacher / Adviser | school_attendance (+_update), school_grades (+_update), school_grade_release |
Take & save attendance, encode WW/PT/QA, submit grades for release. Cannot approve/release. |
| Principal / School head | school_grades, school_grade_approve, school_reports, school_export (+ read access across the pages they oversee) |
Approve & release grades, generate report cards, oversee enrollment, read reports & the audit trail. |
| Guidance | school_support (+_create/_update), school_child_protection (+_create/_update), school_health |
Open & work support cases, handle confidential safeguarding cases, view restricted health records. |
| Clinic / Nurse | school_health |
View restricted learner health / medical records (audited on view). |
| System administrator | school_settings, plus whichever page permits are needed for provisioning/troubleshooting |
Configure School Settings (audited), manage portals, provision portal logins. |
| Front desk / Gate | school_visitors (+_create) |
Issue passes, check visitors in/out (scan audited), revoke passes. |
school_enrollment, school_learners, school_guardians,
school_personnel, school_academics, school_lms,
school_attendance, school_grades, school_communication,
school_support, school_visitors, school_facilities,
school_reports, school_settings), CRUD children on the pages that
create/edit/delete records, and the restricted/SoD permits below. The exhaustive list is on
the Reference page.
Segregation of duties & restricted permits
Four permits carry extra rules. Treat them deliberately — this is where the module’s child-safety and Data-Privacy posture lives.
school_grade_release
lets a teacher/encoder submit grades; school_grade_approve lets the head
approve, release, and generate report cards. The encoder can never approve their own
grades — even if an account somehow held both permits, self-publishing is blocked. Assign
release to teachers and approve to the head only. See Grading.
school_grade_releaseSubmit grades for release — the encoder’s permit.school_grade_approveApprove, publish & make report cards — a different person than the encoder.school_healthView learner health/medical — audited on every view (view_health).school_child_protectionChild-protection / safeguarding (+_create/_update) — segregated, audited on read (view_safeguarding).school_exportExport / compliance downloads — the masterlist export is audited (export).school_child_protection. Every read of a
safeguarding case or a health record is audited (critical). Grant these permits only to the
people who genuinely need them. See Data Privacy & Safeguarding
and the Guidance & Clinic Playbook.
Which permission unlocks which page
The 14 staff pages in the School sidebar group, each with the base permit that reveals it and the notable action permits. (Two pages carry an extra menu gate — a setting that must be on before the menu item appears at all.)
| Page | Route | Base permit | Notable action permits / gates |
|---|---|---|---|
| Dashboard | school | school | Permission-filtered quick-link cards. |
| Enrollment & Admissions | school/enrollment | school_enrollment | _create/_update/_delete; approve/reject need _update. |
| Learners | school/learners | school_learners | _create/_update/_delete; provision portal needs _update. |
| Parents & Guardians | school/guardians | school_guardians | _create/_update/_delete; verify link & provision portal need _update. |
| Personnel & Teachers | school/personnel | school_personnel | _create/_update/_delete. |
| Academic Structure | school/academics | school_academics | _create/_update/_delete across the tabs. |
| LMS Bridge | school/lms_bridge | school_lms | Menu also gated by module_courses (Learn). Fail-safe when off. |
| Attendance | school/attendance | school_attendance | Marking/bulk-save needs school_attendance_update. |
| Grades & Report Cards | school/grades · school/report_cards | school_grades | Encode needs _update; submit needs school_grade_release; approve/release/report cards need school_grade_approve. |
| Communication | school/communication | school_communication | Launcher tiles gated by module_announcement/module_message/module_event. |
| Student Support | school/support | school_support | _create/_update. Guarded link into Safeguarding for school_child_protection holders. |
| Safeguarding confidential | school/safeguarding | school_child_protection | Restricted (+_create/_update); every read audited. |
| Visitor Pass | school/visitors | school_visitors | Menu gated by school_visitor_pass_enabled; issue/scan need _create. |
| Facilities & Rooms | school/facilities | school_facilities | _create/_update/_delete; facility tickets via Helpdesk (fail-safe). |
| Reports & Compliance | school/reports | school_reports | Masterlist export needs school_export (audited). |
| School Settings | school/settings | school_settings | Saving is audited (update_settings). |
Learner Health is a restricted view (school_health) surfaced where the
domain appears, and is audited on view. The full route/permission catalog is on
Reference.
Portal audiences (not staff)
Parents and students are not staff users and don’t appear in the Roles editor — they are core customer accounts, distinguished by their guardian/learner link. Their access is governed by settings and the verified link, not by staff permissions.
| Portal | Route | What lets them in | What they see |
|---|---|---|---|
| Parent portal | school/parent |
module_school and school_parent_portal_enabled on; core allow_customer_signin on; a provisioned login; and a verified guardian link. |
Only their verified children, and only released grades, plus each child’s attendance summary and active enrollment. |
| Student portal | school/student |
module_school and school_student_portal_enabled on; core allow_customer_signin on; a login linked to their learner record. |
Their own released grades, attendance summary, and active enrollment. If not linked to a learner, a “no record” page shows. |