Setup and administration
How do you manage user roles and action permissions in Course?
A user's assigned role determines their action permissions in Course. On the role editing screen, permissions are grouped by module and can be searched by name or description. Saving the selected permissions updates the set of permissions associated with that role, affecting users assigned to it.
A role's name, its action permissions, and its data-scope preference are different pieces of information. The presence of data-scope options on the screen should not be presented as proof that every record query enforces those options as an access rule.
On this page
Edit action permissions with care
Review the role and its users.
Check the role's name and the users assigned to it. Bear in mind that a change can affect other people who use the same role.
Search for the permission you need.
Find the relevant action using the permission search field. Read the descriptions of distinct permissions, such as viewing, managing, approving, and revoking approval.
Adjust the selection.
Select individual permissions or the permissions in a visible group. While a search is active, bulk selection applies to the visible results; do not assume permissions outside those results were selected.
Save and verify the actual behavior.
Save the role, then check the relevant screen and action using the affected user's account. Do not conclude from the role screen alone that scope preferences restrict visibility of every record.
Distinguish the different access concepts
Whether a button appears or is hidden does not, by itself, explain all data access. Evaluate permission to perform an action separately from rules governing access to a particular record.
| Concept | What it currently means |
|---|---|
| Action permission | Determines whether the user may carry out a protected action. |
| Role | The definition that associates a set of permissions with a user. |
| Data-scope preference | Scope information stored on the role; general query restrictions are not fully implemented. |
| Institution or brand filter | Narrows what a screen or report shows; it is not an access-control mechanism on its own. |
| Linked teacher account | Checked separately for certain actions, such as access to the teacher's own lesson session. |
Why do related actions have separate permissions?
Approving a sale and revoking its approval require separate permissions. Likewise, managing a lesson plan and blocking a time slot require different checks. Access to a screen does not mean a user can perform every management action available there.
A user linked to a teacher account may mark attendance for their own lesson session under a specific access rule. Broader attendance permission is a separate route. Check the particular action to determine which permission or account relationship the user needs.
Account for system roles and scope limits
System-defined roles are protected from editing. If an edit is rejected, check the system-role protection and the permission for the action; do not treat the rejection as a temporary form error. When a custom role is changed, its full selected permission set is saved.
If you need strict separation of records between institutions or advisors, do not assume the current scope options provide it. The necessary record-access rules must be implemented and verified separately. This page describes the action permissions that currently exist; it does not present unfinished scope enforcement as an available feature.
Frequently asked questions
Does naming a role 'Administrator' grant every permission?
No. Permissions depend on the saved permission keys, not the role's name. Review the selected permissions separately.
Does 'Select all' select the entire catalog while a search is active?
Bulk selection on the role screen applies to permissions that remain visible in the search results. Review selections outside those results separately.
Does choosing an institution-level scope provide data separation on its own?
No. In the current version, scope is not a general restriction applied to every query. Do not base a security requirement solely on that selection.
Assess how Course fits your institution's workflow
Explore the features described on this page in your account, or discuss your institution's needs with our team.