Role-based access control: understanding permission boundaries

The principle of least privilege

School Vault assigns permissions based on the principle of least privilege: each role can access only the data and actions required to do their job. This protects children's data, limits the damage of a compromised account, and ensures compliance with NDPR.

Full role descriptions are in article 1.4. This article focuses on the permission boundaries that matter most for data protection.

Key permission boundaries by role group

Leadership (School Owner, Admin, Principal, Vice Principal)

• Can view and export all records across all sections
• Can change staff roles and permissions
• Can access the audit log
• Can view financial records and subscription settings
• Cannot delete audit log entries

Academic staff (Class Teacher, Subject Teacher, Assistant Teacher, Key Person, Curriculum Lead)

• Can view and edit records for their assigned class(es) only
• Cannot view records for classes they are not assigned to
• Cannot view financial records or subscription settings
• Cannot view health records (except Class Teachers, who can view wellness notes for their class)
• Cannot access the audit log

Welfare and health (School Nurse)

• Can view and edit health records and wellness logs for all students
• Cannot view financial records
• Cannot view Learning Journal observations or assessment marks
• Cannot access the audit log

Finance (Bursar, Office Staff)

• Can view and manage fee records, bills, and payments
• Cannot view health records, Learning Journals, or attendance records
• The Bursar can access the Paystack integration settings; Office Staff cannot

Security and operations (Registrar, Security/Gate Officer, Driver)

• Registrar: can view and manage student enrolment, profiles, and pickup authorisation
• Security/Gate Officer: can scan QR codes and view the fire register; cannot see health, financial, or academic records
• Driver: can view their assigned student list and GPS tracking if enabled; no other data access

Parents

• Can view their own child's records only (attendance, daily reports, Learning Journal, fees, homework, report cards)
• Cannot view any other child's records
• Cannot view staff-only notes or internal assessments
• Cannot access any admin settings

Reviewing staff roles

1. Go to Staff from the sidebar. The Overview shows all staff and their current roles.
2. Click a staff member to view their profile, role, and class assignments.
3. To change a role: click Edit Role, select the new role from the dropdown, and save. The change takes effect immediately.

Common mistakes

• Assigning School Admin to multiple people "for convenience", each additional admin is an additional attack surface. Keep the admin role to the minimum number of people who genuinely need it.
• Using a shared login for multiple staff members, shared logins make the audit log useless (you cannot tell which person took an action) and violate NDPR requirements for individual accountability.
• Not updating roles when a teacher changes responsibilities, a former class teacher who becomes a subject teacher should have their role updated. Otherwise they retain class teacher access to their former class.