Manage staff accounts and permissions

Access control has two layers: user accounts (who can sign in) and roles (what they can see and do).

1. Create staff accounts

Open System Administration → User Accounts and add a user for each staff member: name, email, and the role(s) they should hold. The user receives an activation email and sets their own password.

2. Choose from built-in roles

The platform ships sensible defaults (teacher, bursar, administrator, and so on). Attach one or more to a user; their sidebar and abilities update to match.

3. Build a custom role

When a job needs exactly one slice of access:

1. Open System Administration → Roles & Permissions.
2. Create a new role and name it after the job (for example "Grade 7 Coordinator").
3. Tick only the resources and actions this role needs — students in read-only, report cards for their class, nothing in finance, and so on.
4. Save, then assign the role to the user.

Custom roles are the right tool when a staff member should touch one area deeply but never see another.

Principles that keep schools safe

• Least privilege — grant what the job needs, nothing more.
• Separate money from academics — bursars get finance; teachers get marks; few people need both fully.
• Review on departure — deactivate the account the same day someone leaves; do not delete users who have historical records attached.