Roles answer what a user may do, but not to whom; our configurable RBAC adds a scope resolver and field-level masking, so access stays least-privilege by default and a school can delegate permissions without a developer.
Access control looks finished before it is
Access control is one of those features that looks finished long before it actually is. A dropdown of roles, a few permission checkboxes, screens that show or hide based on the role; it demos beautifully.
Then it meets a real school, with a structure that does not match your fixed list of roles and a coordinator who needs exactly one more permission than their title implies, and the gaps start to show.
Roles are the easy half
We ship sensible system roles such as admin, principal, teacher, accountant, receptionist and parent, and let a school define unlimited custom ones on top. Permissions gate both the navigation and the APIs behind it, which matters more than it sounds: a role never sees a module it cannot use, and it cannot reach that module by guessing a URL either.
Hiding a button while leaving its endpoint open is not access control; it is decoration. So the permission is checked where the work actually happens. That is the easy half, and most systems stop there. But roles alone answer the wrong question.
The question roles do not answer: scope
That a teacher can view students is true and nearly useless. Which students? Their class, not the whole school. A head of department can see staff, meaning their department, not everyone. The dangerous simplification is to grant a broad permission to view students and trust the interface to narrow it down.
So we separate two concerns that are easy to conflate. A permission says what kind of action is allowed; a scope resolver decides which rows it applies to. A supervisor or class teacher sees exactly the people and records they are responsible for, resolved through the same organisation-and-scope map that routes approvals, without ever being handed a blanket view of the school. Access control is two questions, not one: what may you do, and to whom. A system that answers only the first will quietly leak the second, usually through a report or an export that forgot to narrow the scope.
Field-tier masking and delegation
Even within a single record, not every field is for every role. A class teacher needs a student's academic history; they do not need the family's financial notes. So visibility runs down to the field, not just the record: the same student profile presents different fields to different roles. It is the difference between hiding a page and redacting a document, and for records as sensitive as a child's, redaction is the right default.
This is where config-first meets access control. When a school creates a designation, say an examination coordinator, it should not have to file a ticket to get that role the right permissions. So a designation carries a permission template: a suggested set of roles and permissions for that job. But the template is suggested, then reviewed and granted by a person with authority. It is never auto-applied. The system proposes a sensible default; a human confirms it. Convenience and least privilege do not have to be in tension, as long as you keep a human in the loop at the moment of granting.
Safe by default, and why we did not shortcut
Put together, the model has a deliberate posture: least privilege by default, delegation by configuration, everything auditable. A new role starts with nothing and is granted only what it needs. Scope narrows every permission to a person's actual remit. Sensitive fields stay masked unless a role has earned them. And because access grants and access decisions run through the same audited spine as the rest of the platform, a school can answer the question that actually matters when trust is on the line: who could see this, and who gave them that access?
The shortcut of broad roles, interface-level filtering and hard-coded scopes is faster to build and it demos without a flaw. It also fails quietly: at the school with an unusual structure, at the coordinator who needs one extra permission, at the audit that asks who granted what. Role and scope access control with real scope resolution and field-level masking is more work up front. It is also the only version that survives contact with a real school, run by real people, for years.