Custom roles for administration

Custom roles restrict the rights of an administrator account. The principle is subtractive: you start from an administration scope, then remove the modules or operations the person must not be able to use.

This is the option to enable in order to delegate part of the administration without granting all global rights.

Why not grant all administration rights?

The standard administrator role grants all rights on the school account. For many coordination functions, this is too much:

• an absence coordinator needs to view and manage absences, but not edit the timetables or the global settings;
• a timetable manager needs to build the timetables without necessarily having access to import / export;
• an HR department may need to edit teacher records without touching the courses;
• a facilities team may need to view rooms, display panels or resources without managing users.

What the form offers

The Custom roles screen offers:

• a role name;
• permissions per module;
• permissions per operation, depending on what each module exposes.

Permissions apply to modules and their operations, not to the data itself: a custom role does not restrict access to a specific class, site, subject or period. It delimits what the person can do, not the data they can act on.

Assign a custom role

Once created, the role appears in the role selectors of the user records. You assign it to an administrator account like any other role.

A user can combine several standard and custom roles. They then obtain the union of the remaining permissions.

Typical use cases

• Student affairs / supervisors — rights on absences, Staffing and timetable viewing, without access to the configuration.
• Academic coordinators — rights on the relevant timetable screens, without global settings.
• Facilities team — access to rooms, display panels or resources depending on the authorized operations.
• Administrative assistants — management of students or teachers without access to sensitive settings.

Auditability

Actions performed with a custom role appear in the logs when the logs option is active and the route in question is logged. See Activity log (logs).