Roles and permissions

Settings → Roles & Permissions lists your System Roles — created when your facility was set up — and any Custom Roles you add. Each card shows how many permissions it grants and how many employees hold it.

Edit a role’s permissions

Select Edit Permissions on a system role, or Edit on a custom one. The matrix groups permissions by category: children, attendance, classrooms, employees, parents and guardians, tuition and billing, medical and health, registrations, curriculum, photos and media, messaging, reports, schedules, child development, and settings. Select all and Deselect all work per category.

A system role’s name and description cannot be changed, and it cannot be deleted.

Create a custom role

Create Custom Role, then a Role Name such as “Weekend Supervisor”, a Description of what it is for, and the permissions. Create Role saves it.

Build custom roles around jobs rather than people, so they survive staff changes.

Assign a role

Roles are assigned on the person: Employees → the person → Roles & Permissions. Someone can hold several, and their effective permissions are the combination.

How much a role actually restricts today

Be clear-eyed about this, because it decides how you staff your facility.

Enforced. Tuition & Billing, Reports, Employees, Compliance and Roles & Permissions are checked by the server. Someone without the permission is refused, and the sidebar does not offer them the link.

Not yet enforced. The remaining areas — children and their medical records, classrooms, attendance, curriculum, messaging, photos, enrollment and the other settings pages — are not blocked by the server today. Assigning a limited role does not stop a signed-in staff user from opening those screens directly.

Two administrator flags bypass every check: an account administrator and a facility administrator can reach everything regardless of the permissions on their role.

What that means for you:

• For anything not in the enforced list, the real control is who you invite. If a person must not see a child’s medical record, do not give them a facility account — set their employee status the day they leave, and keep your user list short.
• Keep roles accurate anyway. They are what enforcement uses as it is extended, they drive what the sidebar offers, and they document your intent in the meantime.
• Grant the administrator roles to as few people as possible, since they bypass the rest.

Deleting

Deleting a custom role happens immediately, with no confirmation. Check who holds it first — the employee count is on the card.