> ## Documentation Index
> Fetch the complete documentation index at: https://educontroldoc.pixelspectivetech.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions reference

> Every permission in EduControl, what it lets someone do, and how they combine into roles.

A role is a set of permissions. A member of staff has one role, and it decides every screen they can reach.

## Pupils and staff

| Permission        | Lets someone                                            |
| ----------------- | ------------------------------------------------------- |
| `view_students`   | View pupil records                                      |
| `edit_students`   | Admit and edit pupils, manage guardians and portal PINs |
| `view_teachers`   | View staff records                                      |
| `edit_teachers`   | Add and edit staff records                              |
| `view_attendance` | View registers                                          |
| `edit_attendance` | Mark registers and the meal register                    |

## Academics

| Permission        | Lets someone                                                                   |
| ----------------- | ------------------------------------------------------------------------------ |
| `view_academics`  | View classes, subjects and the calendar                                        |
| `edit_academics`  | Edit classes, subjects, the calendar, timetables, grading scales; close a term |
| `enter_marks`     | Create tests, enter marks, write remarks, mark a class Ready                   |
| `publish_reports` | Publish and withdraw report cards                                              |
| `view_reports`    | View report cards                                                              |

## Finance

| Permission            | Lets someone                                                      |
| --------------------- | ----------------------------------------------------------------- |
| `view_finances`       | View fees, invoices and the cash ledger                           |
| `edit_finances`       | Edit the fee grid, run billing, issue credit notes, void payments |
| `record_payments`     | Record payments and issue receipts                                |
| `approve_fee_changes` | Approve changes to the fee grid                                   |
| `approve_refunds`     | Approve or reject a refund                                        |
| `approve_waivers`     | Approve waivers and arrears overrides                             |

## Administration

| Permission               | Lets someone                                           |
| ------------------------ | ------------------------------------------------------ |
| `manage_users`           | Create staff accounts, assign roles, deactivate people |
| `manage_school_settings` | Edit school branding and reference number prefixes     |
| `view_audit`             | View the audit log                                     |

## Separating doing from approving

The four `approve_*` permissions exist to be held by somebody other than the person doing the work.

<Warning>
  Refunds enforce this in the system, not merely in policy: **the person who requested a refund cannot approve it**, at any amount, whatever their role says.

  Give `approve_refunds` to at least two people. A school where only the bursar holds it cannot process a refund the bursar requested — and cannot process any refund at all while the bursar is away.
</Warning>

## Suggested roles

| Role              | Permissions                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------ |
| **Cashier**       | `record_payments`, `view_finances`, `view_students`                                              |
| **Bursar**        | The cashier's set, plus `edit_finances`                                                          |
| **Class teacher** | `view_students`, `view_attendance`, `edit_attendance`, `enter_marks`, `view_reports`             |
| **Head teacher**  | `view_*` across the board, `publish_reports`, `approve_refunds`, `approve_waivers`, `view_audit` |
| **Administrator** | `manage_users`, `manage_school_settings`, `edit_academics`, `edit_students`, `edit_teachers`     |

Adjust to how your school actually divides the work. The one arrangement worth keeping is that whoever approves refunds is not whoever records payments.

## Changing someone's role

Takes effect the next time they load a screen. Managed on User Management by someone with `manage_users` — see [Staff and roles](/docs/before-the-term/staff-and-roles).