Permission matrix
This page lists the permissions each EduPrefect role is granted. It is generated from the permission catalogue the authorisation layer resolves against, and regenerated in CI, so the table cannot drift from the catalogue.
⚠️ Read this as the grant, not as a guarantee about every screen. The catalogue is what a role is given; each endpoint separately names the permission it demands. Some permissions listed here are defined but not yet demanded anywhere — holding one of those grants no ability today. If you are answering a security questionnaire, cite this page for what a role is granted and ask us for the enforcement map.
A role may also be scoped, which narrows the permissions below to a
subset of the school — a form teacher holds take_attendance, but only for
their own classes. Scopes are listed with each role.
The roles
Section titled “The roles”Admin roles
Section titled “Admin roles”| Role | Name | Scope | Permissions |
|---|---|---|---|
proprietor |
Proprietor / Owner | whole school | 69 |
principal |
Principal / Head of School | whole school | 49 |
head_teacher |
Head Teacher | own_section |
27 |
bursar |
Bursar / Accountant | whole school | 17 |
admin |
School Administrator (IT) | whole school | 25 |
registrar |
Registrar / Admissions | whole school | 13 |
vice_principal |
Vice-Principal | own_section |
32 |
Staff roles
Section titled “Staff roles”| Role | Name | Scope | Permissions |
|---|---|---|---|
teacher |
Teacher | own_classes |
15 |
support |
Support Staff | whole school | 0 |
form_teacher |
Form / Class Teacher | own_classes |
15 |
subject_teacher |
Subject Teacher | own_subjects |
12 |
counselor |
Counselor | whole school | 4 |
External roles
Section titled “External roles”| Role | Name | Scope | Permissions |
|---|---|---|---|
guardian |
Parent / Guardian | own_children |
6 |
What each role may do
Section titled “What each role may do”A tick means the role holds that permission. Tables scroll sideways on narrow screens.
Academics
Section titled “Academics”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| view_academics View grades/results read-only |
✓ | ✓ | ✓ | · | · | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ |
| enter_grades Enter CA/exam scores for own subject+class |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | ✓ | · | · |
| edit_grades Modify already-entered grades |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | ✓ | · | · |
| enter_affective_psychomotor Enter WAEC affective + psychomotor domains |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | · | · | · |
| compile_report_card Assemble + comment on a report card |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | · | · | · |
| lock_results Freeze a term’s results from edits |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · |
| publish_results Release results to parents/students |
✓ | ✓ | · | · | · | · | ✓ | · | · | · | · | · | · |
| unpublish_results Reverse a results publish |
✓ | ✓ | · | · | · | · | ✓ | · | · | · | · | · | · |
| unlock_results Reverse a results lock |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · |
| manage_subjects CRUD subjects, assign teachers |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · |
| manage_classes CRUD classes/arms, assign form teachers |
✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · | · |
| manage_timetable Edit the timetable |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · |
| manage_assessment_scheme Define CA/exam weightings + grade bands |
✓ | ✓ | · | · | · | · | · | · | · | · | · | · | · |
| upload_lesson_notes Upload lesson notes |
✓ | · | ✓ | · | · | · | · | ✓ | · | ✓ | ✓ | · | · |
| approve_lesson_notes Approve submitted lesson notes |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | · | · |
Attendance
Section titled “Attendance”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| take_attendance Mark the register for own class/session |
✓ | · | ✓ | · | · | · | · | ✓ | · | ✓ | ✓ | · | · |
| amend_attendance Change a past attendance record |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | · | · | · |
| view_attendance Read attendance |
✓ | ✓ | ✓ | · | · | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ |
| manage_attendance_policy Configure sessions + lateness rules |
✓ | ✓ | · | · | ✓ | · | ✓ | · | · | · | · | · | · |
| export_attendance Export attendance data |
✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | · | · | · | · | · |
Fees & finance
Section titled “Fees & finance”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| view_fees Read invoices/balances |
✓ | ✓ | · | ✓ | · | · | ✓ | · | · | · | · | · | ✓ |
| manage_fee_structure Define termly fee items, discounts, waivers |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| issue_invoice Generate invoices |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| edit_invoice Adjust line items pre-payment |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| void_invoice Cancel an invoice |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| approve_void Approve an invoice void (separation of duties) |
✓ | ✓ | · | · | · | · | · | · | · | · | · | · | · |
| approve_discount Approve a discount (separation of duties) |
✓ | ✓ | · | · | · | · | · | · | · | · | · | · | · |
| record_payment Record a payment incl. cash |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| reverse_payment Reverse a wrongly-recorded payment |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| reconcile_payments Match virtual-account deposits |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| apply_waiver Apply a staff-child / scholarship waiver |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| configure_result_withholding Toggle withhold-results-when-fees-owed |
✓ | ✓ | · | · | · | · | · | · | · | · | · | · | · |
| override_result_withholding Release a student’s results despite arrears |
✓ | ✓ | · | · | · | · | · | · | · | · | · | · | · |
| export_financial_data Export financial data |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| pay_fees Make a fee payment (external) |
✓ | · | · | · | · | · | · | · | · | · | · | · | ✓ |
Payroll
Section titled “Payroll”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| view_payroll Read salary structures, runs + payslips |
✓ | ✓ | · | ✓ | · | · | · | · | · | · | · | · | · |
| manage_salary_structures Set staff salary structures |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| run_payroll Open + compute a payroll run |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
| finalize_payroll Lock a payroll run (separation of duties) |
✓ | · | · | ✓ | · | · | · | · | · | · | · | · | · |
Communications
Section titled “Communications”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| send_announcement School/section/class broadcast |
✓ | ✓ | ✓ | · | ✓ | · | ✓ | · | · | · | · | · | · |
| send_class_message Message guardians of own class |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | ✓ | · | · |
| send_direct_message 1:1 message with a guardian |
✓ | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | ✓ | ✓ | · | · |
| send_sms Send SMS (paid channel) |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| send_whatsapp Send WhatsApp (paid channel) |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_comms_templates Manage message templates |
✓ | ✓ | · | · | ✓ | · | ✓ | · | · | · | · | · | · |
| view_comms_log Audit sent messages |
✓ | ✓ | ✓ | · | ✓ | · | ✓ | · | · | · | · | · | · |
| receive_announcements Receive announcements (external) |
✓ | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | ✓ | ✓ | · | ✓ |
| reply_message Reply to a message (external) |
✓ | ✓ | ✓ | · | · | · | ✓ | ✓ | · | ✓ | ✓ | · | ✓ |
People & school administration
Section titled “People & school administration”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manage_staff Invite/CRUD staff, link accounts |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_roles Assign/revoke roles to accounts |
✓ | · | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_custom_roles Create/edit custom roles + their permissions |
✓ | · | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_students CRUD student records + PII |
✓ | ✓ | · | · | ✓ | ✓ | · | · | · | · | · | · | · |
| view_student_pii See sensitive student PII |
✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | · |
| manage_admissions Manage the admissions pipeline |
✓ | ✓ | · | · | ✓ | ✓ | ✓ | · | · | · | · | · | · |
| manage_school_settings Branding, terms, calendar, integrations |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_integrations Payment/SMS provider config + secrets |
✓ | · | · | · | ✓ | · | · | · | · | · | · | · | · |
| manage_billing The SaaS subscription (Prefect’s bill) |
✓ | · | · | · | · | · | · | · | · | · | · | · | · |
| delete_school Destructive school deletion |
✓ | · | · | · | · | · | · | · | · | · | · | · | · |
Reports & analytics
Section titled “Reports & analytics”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| view_reports Dashboards/analytics |
✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | · | · | · | · |
| view_analytics At-risk early-warning + insight analytics |
✓ | ✓ | ✓ | · | · | · | ✓ | · | · | · | · | ✓ | · |
| export_data Bulk export (CSV/PDF) |
✓ | ✓ | · | · | ✓ | ✓ | ✓ | · | · | · | · | · | · |
| export_nemis NEMIS regulatory return |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| export_state_moe State MoE regulatory return |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| view_audit_log View the audit log |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manage_forms Build, edit + publish forms |
✓ | ✓ | · | · | ✓ | ✓ | · | · | · | · | · | · | · |
| view_form_responses View + export submitted form responses |
✓ | ✓ | ✓ | · | ✓ | ✓ | ✓ | · | · | · | · | · | · |
Duty roster
Section titled “Duty roster”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manage_duty_roster Create/edit duty rosters + auto-generate + assign |
✓ | ✓ | ✓ | · | ✓ | · | ✓ | · | · | · | · | · | · |
| view_duty_roster View duty rosters + coverage (read-only) |
✓ | ✓ | ✓ | · | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | · | · |
School website
Section titled “School website”| Permission | proprietor |
principal |
head_teacher |
bursar |
admin |
registrar |
vice_principal |
teacher |
support |
form_teacher |
subject_teacher |
counselor |
guardian |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manage_site Edit the school website content + approve/publish it |
✓ | ✓ | · | · | ✓ | · | · | · | · | · | · | · | · |
Reading this page
Section titled “Reading this page”Three limits, stated plainly because this page gets cited:
- Your school may have roles that are not here. A school with the Manage custom roles permission can define its own, carrying any combination of the permissions below. Only the built-in roles are listed.
- A permission listed here is a grant, not proof of a working screen. Some are defined and not yet demanded by any endpoint.
- A role that already exists in a live school keeps what it was given. Re-seeding adds new grants; it does not take away one that has been removed from the catalogue since. So immediately after a permission is withdrawn, this page is right about the intent and a long-running school may lag it.
Holding a permission is necessary but not always sufficient. Some actions additionally require a second person to approve them — see separation of duties — and scoped roles only ever act within their own section, classes, or children.