Permissions reference

This is every area you can set in the role editor on Admin › People › Roles, and what each level lets someone do. Use it when you're deciding what a role should hold. How to change a role.

How levels work#

Each area has up to four levels:

• None. Nothing in this area.
• View. See it.
• Edit. See it and change it.
• Full. Everything, including deleting and managing it.

Each level includes the one before it: Full holds everything Edit does, and more. When a level would add nothing, the area leaves it out, so some areas offer only None and View.

Levels decide what someone can do. Their role's reach decides which records they do it to. How reach works.

Areas and levels#

In the order the editor lists them.

Insights#

Every account has it.

• View: open Insights and the IT and Facilities dashboards.

Reports#

Every account has it.

• View: open the report builder, make their own reports and share them with the account or with chosen roles.
• Edit: also email their own saved reports on a schedule to people on the district's email domains (Schedule report emails, reports.schedule). Schedule a report.
• Full: also change, unshare or remove reports other people shared in the account (Manage everyone's shared reports, reports.manage).

Tickets#

Needs schoolHelpdesk.

• View: see tickets within their reach, and open new ones. This is what a requester needs.
• Edit: work tickets as helpdesk staff: reply, change status and fields, assign, merge and close, and see internal notes and files. Count as the team for response times.
• Full: also archive tickets, see archived tickets with the Archived filter and restore them (Archive tickets, tickets.delete), and reopen closed ones. Tickets are never deleted: archiving can always be undone.

Helpdesk settings#

Needs schoolHelpdesk.

• View: open the ticket status, priority, tag and field settings.
• Full: manage topics, statuses, priorities, tags, fields, routing, macros, SLAs and time tracking, set up repair kiosks (Manage kiosks, kiosks.manage), and change the settings on General (reply box, sender verification, auto-response, removing personal information), the ticket lifecycle on Overview, and the ticketing switches on AI Features. Opening Admin alone lets someone see these settings, not change them.

Tasks#

Needs schoolHelpdesk.

• View: see tasks.
• Edit: create tasks, start checklists, and edit and complete tasks.
• Full: also delete tasks.

Work orders#

Work orders have no area of their own. They're tickets in your Facilities department, so the Tickets area covers them: Edit works them, including completing them, and Full archives them. Who can work in Facilities is its department membership. See Work orders.

Assets#

Needs schoolAssets.

• View: see assets, repairs and asset reports, and export the asset list.
• Edit: also add and import assets, log repairs (charging a fee on one included), edit assets and send device commands, change status (in repair, lost, retired and so on), and assign assets to people.
• Full: also retire and delete assets.

Fines#

Needs schoolAssets.

• View: open Admin › People › Fines and export it, and see fines on people's profiles, on a device's repairs and timeline, in the People list's Outstanding Fines column, in reports and in Otto's answers (View fines, fines.view). Without it, repairs show with no fee. A person always sees their own fines.
• Edit: also mark fines assessed or paid, one at a time or in bulk, move them back, change the fee on a logged repair, and import paid fines from a CSV (Manage fines, fines.manage).

Which fines someone sees follows their role's reach for assets. Charging a fee while logging a repair is the Assets area's (Add assets); settling it is this one's. Roles that held Add assets have both to start with, and agent roles that can see assets have View.

Inventory & parts#

Needs schoolAssets.

• View: open the Facilities inventory page and the Parts page, and see parts, their stock and the devices they're linked to.
• Edit: also add parts and stock, change parts (including the minimum quantity that marks them Low Stock), and link them to devices.
• Full: also delete parts nothing uses (no stock and no linked devices).

Check-in/out#

Needs schoolAssets.

• View: open Check-in/out and see check-in history.
• Edit: also check assets in and out and add check-in notes. This doesn't let them edit the asset itself.

Audits#

Needs schoolAssets.

• View: open audits.
• Edit: also scan devices in an active audit and mark them confirmed or missing, without editing the asset.
• Full: also start, edit, schedule, close and delete audits.

Asset settings#

Needs schoolAssets.

• View: open asset types, repair types, statuses, tags, fields, custom fields, file categories, funding sources, manufacturers and models.
• Edit: also add and change asset and repair types, statuses, tag settings, funding sources and their budgets, manufacturers and models.
• Full: also remove statuses, manufacturers and models, manage depreciation schedules, add, change, reorder and delete asset fields, and save the asset label design.

schoolAgent#

Needs schoolAgent.

• View: chat with your account's agent.
• Full: also run the agent: its settings, conversations and analytics.

Knowledge#

Needs schoolAgent.

• View: read knowledge meant for them.
• Full: manage knowledge sources and verified answers. It doesn't reach your help center's articles: that's Help Center.

Help Center#

Needs schoolHelpdesk or schoolAgent.

• View: see help center Insights, Suggested articles, Due for review and Conflicting articles, dismiss a suggestion, and get the New suggested articles notification.
• Edit: also write articles, edit any article (published ones and other people's drafts) and restore a version, and organize categories and sections, including moving articles between them. Editing any article also covers keeping articles current: Mark reviewed, an article's owner and review cycle, checking for and dismissing conflicting articles, and the Articles due for review notification.
• Full: also publish, move back to draft and archive articles, delete them, and manage the help center's settings: branding, layout, who can open it and its address.

Under Advanced each of these is its own permission: Write articles, Edit any article, Publish and unpublish, Delete articles, Organize categories, Manage the help center and See help center insights. Someone with Write articles but not Edit any article changes only drafts they wrote, and without Publish and unpublish they save drafts that someone who can publish then publishes. Who can do what.

Otto#

Depends on your plan.

• View: ask Otto about your account's data.
• Full: also manage Otto: its capabilities, suggested prompts and prompt review. It doesn't need schoolAgent.

AI assistants#

Depends on your plan.

• View: connect Claude, ChatGPT or Microsoft Copilot to ask about your account's numbers. Assistants get totals only, never individual records.
• Full: also turn AI assistants on or off for your account, and see and disconnect everyone's connections.

Saved views#

Every account has it.

• View: share a saved view with other people.
• Full: also manage the shared views a whole department sees.

Workflows#

Needs schoolAutomate.

• View: build, edit and run workflows.

Users#

Every account has it.

• View: see people and teams, and open people fields.
• Edit: also add and import people, send invites, edit people and their teams, and deactivate or reactivate them.
• Full: also delete people and teams (Delete people), change someone's role, see your account's roles, and add, change and archive people fields.

Locations#

Every account has it.

• View: see districts, schools, buildings and rooms, and open location fields.
• Edit: also add, import and edit districts, schools, locations and rooms.
• Full: also remove locations and rooms, and manage location fields.

Admin console#

Every account has it.

• View: open Admin, and see account settings, branding, subscriptions, the audit log and data-sharing partners.
• Edit: also change account and district settings, branding, domains and departments, manage who belongs to each department, and manage integrations (MDM, roster sync, Drive, OneDrive and other helpdesks).
• Full: also undo a change recorded in the audit log.

Which level should I choose?#

Start every area at None, and raise only the ones the job needs. A few common jobs in a K-12 district:

| Job | Raise | Don't raise | | --- | --- | --- | | Campus tech fixing Chromebooks at one middle school | Tickets Edit, Tasks Edit, Assets Edit, Check-in/out Edit, Audits Edit | Admin console, Users, Asset settings | | Library aide handing out spare Chromebooks | Assets View, Check-in/out Edit | Assets to Edit (Check-in/out works without it), Audits | | Facilities lead running HVAC work orders | Tickets Full, Tasks Full, Inventory & parts Edit | Assets unless they track equipment, Admin console | | Principal who wants to see what's going on | Insights View, Reports View, Tickets View | Everything that changes records | | Help desk lead who sets up the queues | Tickets Full, Helpdesk settings Full, Saved views Full | Users, unless they also manage teams |

• View or Edit on Tickets is the line between asking for help and giving it. Edit makes someone helpdesk staff: they see internal notes and count toward response times.
• Guest is the narrowest role: Tickets at View, with only their own requests, and nothing else. schoolOS fixes it, so it isn't in the editor's built-in roles to change. Who Guests are.
• Edit or Full mostly adds removal: archiving tickets, deleting tasks, retiring assets. Keep Full for the people you'd trust to clean up after others.
• Pair each role with the right reach on Admin › People › Roles. Levels say what; reach says where. The campus tech above also needs Their teams' tickets, assets and tasks, and a team that covers their building.

Individual permissions#

Every level is a set of individual permissions. Under Advanced in the role editor you can pick them one by one, grouped by product. Each has a plain name, like Work tickets or Assign assets to people, and a line saying what it does.

Use Advanced only when no level fits: for example, a role that can change asset status but not add assets. The area then shows Custom.

A few permissions open a page: Open Insights, Build reports, Open Inventory, Open Parts and Open Check-in/out. Open Parts also lets them see parts. Turning a page on under Where they can go gives its permission, and turning it off takes it away.

Some permissions belong to schoolOS staff and never appear in an account's editor: managing accounts, the permission catalog, built-in role defaults and sign-up requests.

When your plan doesn't include an area#

An area whose product your account doesn't have is grayed out. Most say what they need, like Needs schoolAssets. Otto and AI assistants are grayed out with no product named.

You can't change a grayed-out area. Anything a role already holds there stays held, and does nothing until your account has the product. When your account gets the product, that access starts working, so check your roles when your plan changes.