Roles and Permissions

The application combines backend RBAC, frontend route profiles, tenant resolution, and module visibility settings.

Built-In Role Profiles

The frontend maps users to practical workspaces:

• Platform Administration.
• School Administration.
• Executive Dashboard.
• Teacher Workspace.
• Student Dashboard.
• Parent Dashboard.
• Finance Dashboard.
• HR Dashboard.
• Admissions Workspace.
• Library Dashboard.
• Transport Dashboard.
• Health Dashboard.
• Facilities Dashboard.
• Security Dashboard.
• Technology Dashboard.
• Communications Dashboard.
• Limited Workspace.

Permission Checks

Protected API actions require an authenticated JWT bearer token, a resolved tenant, and the required permission. Typical permission names follow the module action pattern, for example students.view, students.create, fees.view, reports.export, or executive_board_reports.view.

Sidebar Visibility

A user sees a module when:

• The module is enabled for the tenant or is a required module.
• The user's role profile allows the route.
• The user has at least one permission required by the module.

Parent, Student, and Teacher Access

Parent, student, and teacher profiles are intentionally narrower than school administration. They focus on personal academic records, communication, notices, attendance, fees, assignments, results, meetings, and related self-service workflows.

Administration

School administrators can manage users, role permissions, translations, enabled modules, communication settings, and school configuration from Settings.