Roles and permissions

A role decides what someone can do in schoolOS and what they can see. Go to Admin › People › Roles to see your roles, change what each one can do, and make roles of your own.

The page has two tabs, because they're two different things:

• schoolOS roles: what someone can do and see in schoolOS. The Built-in roles as your account has them, and Your roles.
• School roles: someone's job at school, like Teacher or Counselor. It says who they are, not what they can do. See School roles.

The tab you pick stays in the page's address, so you can share a link straight to School roles.

schoolOS staff see two more tabs here, for the permissions every account's roles are built from: Permissions, the list of every permission, and Built-in defaults, what each built-in role starts with in a new account. Your account's own copy of each role is what the schoolOS roles tab shows.

Outside an account, schoolOS staff can use schoolOS roles as a read-only view of the global built-in definitions. Open an account to see its people counts, changes to built-in roles, and roles of its own.

schoolOS roles#

Everyone has exactly one schoolOS role. It decides what they can do (its permissions) and what they see of tickets, assets and tasks (its reach).

Built-in roles#

Every account starts with these six. Each row shows what the role sees of tickets, assets and tasks, how many permissions it holds, and how many people have it. A Changed badge means your account changed it from the schoolOS defaults.

• Super Admin. Runs the account: everything your account can do. It can't be changed, so nobody can lock your account out. It shows a lock.
• Agent. Service and support staff who work tickets and assets. It sees All tickets, assets and tasks in the departments they belong to, until your account changes it.
• Staff. Teachers and other staff: they ask for help and follow their own requests.
• Student. Students.
• Guardian. Parents and guardians: they ask for help, and follow their students' requests and devices.
• Guest. People from outside your district, like a vendor who emailed your support address: their own requests only. It can't be changed. See Guests.

Select a role to open it in the role editor. Its … menu has Edit (View when you can't change it) and, on a changed role, Reset to default.

Change a built-in role for your account#

Agent, Staff, Student and Guardian can be changed. Your changes apply only to your account. Guest can't: schoolOS keeps it to a person's own requests, so nobody widens it by mistake.

1. Select the role.
2. Change its settings (see the role editor).
3. Select Save changes. People with the role get the change within a minute.

schoolOS stores only how your version differs from the defaults. When schoolOS later adds a permission to a default, your account gets it too, even if you changed the role.

Put a built-in role back#

A changed role has Reset to default at the bottom of the editor, and in its row's … menu. It removes every change your account made: permissions, what it sees, and the suggested homepage. It asks you to confirm, then takes effect right away. It can't be undone: you'd have to make the changes again by hand.

Older roles#

Some roles from earlier versions of schoolOS were folded into these. The people who had them moved with them:

• District Admin and School Admin became Super Admin.
• Teacher became Staff. Being a teacher now lives in the person's school role, Teacher.
• District Agent and Team Agent became roles of your own, with the same name, permissions and reach, in accounts that used them.

Change a built-in role, or make your own?#

| Option | What it does | Choose it when | | --- | --- | --- | | Change a built-in role | Changes it for everyone who has it. | Everyone with the role should get the change, like letting every Agent archive tickets. | | Make a role of your own | A new role, with its own reach and permissions. People keep their old role until you move them. | Only some people need different access, like the library aides who check Chromebooks in and out, or agents who should see only one school. |

For example, Agent sees All tickets. A district that splits its schools into zones makes a role called "Zone Tech" that sees Their teams' tickets, assets and tasks, gives it to the zone techs, and puts each tech on their zone's team. The district's central agents keep Agent.

Your roles#

Make a role of your own for a job the built-in roles don't fit, like "Librarian" or "Bus Tech." Each row shows what the role is treated as, its reach, its permission count and how many people have it.

1. Select New role.
2. Give it a Name (up to 60 characters, and no other role in your account can have it). Add a description if you like (up to 300 characters).
3. Set what it sees of Tickets, Assets and Tasks (and Departments, when your account uses them). A new role starts with what the built-in role it's treated as sees, until you pick.
4. Pick what it can do.
5. Select Create role.

To change one, select it, make your changes and select Save changes. Once you have more than five, Search your roles... and a Treated as filter appear above the list. Renaming a role doesn't affect the people who have it.

Treated as#

A few places in schoolOS still ask for a built-in role by name: for example, who counts as helpdesk staff, and who can open Admin. For those, schoolOS treats your role as one of three, based on the permissions you pick. The editor shows it as you go:

• Admin, if it can open the Admin console. Treated as a School Admin.
• Staff, if it can work tickets (work orders included), tasks or assets (for example Work tickets, Work as helpdesk staff, Update tasks or Add assets). Treated as an Agent.
• Requester, for everything else. It asks for help rather than giving it. Treated as Staff.

You don't pick it. It follows the permissions, so it changes when they do.

The role editor#

The same editor opens for built-in roles and your own roles. From top to bottom:

What they see#

One choice for each area: Tickets, Assets and Tasks. Parts, Check-in/out and Audits follow Assets. Each has three levels, and Assets a fourth, with a line under each saying what it means. Everyone always sees their own.

| Level | What it does | Choose it when | | --- | --- | --- | | Own | Only what's theirs: tickets they asked for, are assigned, follow or were let in on; assets at their location or assigned to them; tasks assigned to them, made by them, or with a step for them. | People who ask for help rather than give it, like teachers and students. | | Own and their rooms (Assets only) | Assets assigned to them, and devices in or assigned to their rooms. Nothing else at their school. | Teachers who should see their classroom's devices but not the whole building. Give people their rooms on their profile or with the people import. | | Their teams' | Their own, plus what's at every location their teams cover, and their teams' queues and tasks. | People responsible for some schools, not all: zone techs, a campus tech, a maintenance crew for the north side. Put them on the team, and set the team's coverage. | | All | Everything in your account (within their departments, when they're held to them). | People who work across the district: central IT, a help desk that triages everything, a technology director. |

For example, a zone tech's role sees Their teams' tickets, assets and tasks. They're on the Zone 1 team, which covers five schools, so they see those schools' tickets and devices and Zone 1's queue, and nothing at Zone 2's schools. How reach works.

A role with every area at Own or Their teams' is also held to the person's locations elsewhere in schoolOS, like the people list and location pickers. A role with any area at All isn't.

Agent starts at All. Staff, Student, Guardian and Guest start at Own.

Departments#

Shown when your account uses departments. Whether the role stops at the departments a person belongs to:

• Their departments (Agent's default): only in the departments they belong to. Someone in no department works in IT and Facilities. An HVAC tech in Facilities sees work orders, not Chromebook repairs.
• Every department: in every department, like a technology director who oversees IT and Facilities.

Their own records are always theirs, whatever the department.

What they can do#

One level for each part of schoolOS: None, View, Edit or Full. Each level includes the one before it. An area shows only the levels that mean something for it, so some offer just None and View. Every area and level, in plain words.

• A Custom badge means the area was fine-tuned under Advanced and matches no single level.
• An area your plan doesn't include is grayed out and says what it needs, like Needs schoolAssets.
• Your help center's articles have their own area, Help Center, apart from Knowledge: it comes with schoolHelpdesk or schoolAgent. A role that could manage knowledge before it existed got every Help Center permission, so nobody lost access. What each Help Center level allows.
• "Its page is off until … is on" means the area has a level, but the page above it is turned off under Where they can go. Turn that page on, or the level does nothing.

Where they can go#

Every page in schoolOS, as a tree. A checked page is in the person's sidebar. The heading shows how many pages the role can open.

• Checking a page turns it on, with the pages above it. If its area was at None, it comes up to View.
• Unchecking a page turns it off, with everything under it. If that leaves its area with nothing, the area drops to None.
• Checking a page that's already on turns on all the pages under it.

Some pages can't be changed here, and say why:

• Needs schoolAssets (or another product): your plan doesn't include it.
• Guardian only: only that built-in role opens it.
• Comes with …: it has no switch of its own and opens with the page above it.
• Grayed out with no note: the page above it is off.

What they can do and Where they can go change the same set of permissions, so they never disagree. My tickets and My assets aren't in the tree: everyone who signs in can open them, except that a Guest has My tickets only.

Suggested homepage#

Where people with this role land after signing in, until they pick a page of their own. Choose from the pages the role can open, or No suggestion. With no suggestion, they land on the first page they can open.

If you take away the page a role was sent to, the editor warns you and clears the suggestion when you save.

Advanced#

Advanced shows each permission on its own, grouped by product, with a search box. Use it only when the levels don't fit. Anything you change here shows as Custom on its area.

On a built-in role, each permission you changed from the defaults is marked Added or Removed.

A product your plan doesn't include is grayed out, with what it needs. Permissions held there stay held and do nothing until your account has the product. The schoolOS permissions (managing accounts, the permission catalog and sign-up requests) never appear: they belong to schoolOS staff.

Guests#

A Guest is someone from outside your district. When someone who isn't one of your people emails your support address, schoolOS adds them so their email can become a ticket and you can reply:

• At one of your district's own email domains (or a subdomain of one, like students.yourdistrict.org), they're added as Staff, as before. They're your own staff or students that no sync has brought in yet, and a sync later gives them their real role.
• At any other address, they're added as a Guest. Free email like gmail.com or outlook.com always counts as outside.

Your district's own domains are the ones recorded for your account (ask schoolOS support to add one). An account with none recorded treats everyone it doesn't have as a Guest. People brought in by a ticket history import who aren't in your account yet follow the same rule, turned off.

What a Guest can do:

• See the requests they asked for or were copied on, open new ones and reply on them.
• Read your public knowledge (what's shared with Public (guests)).

Nothing else: no devices, no people directory, no one else's requests (not even a student's, the way a Guardian sees them), and no knowledge meant for people signed in.

Signing in as a Guest#

Anyone can email from any address, so a Guest can sign in only once they've proven the address is theirs:

• by selecting the button in a "Confirm your email" email (the one Verify new senders sends, or the one schoolOS sends when they try to sign in first), or
• by signing in with Google or Microsoft, when the provider vouches for the address. That confirms it the same way, and any email held for them becomes a ticket.

Until then, Google or Microsoft sign-in tells them "Confirm your email first. Use the link we sent you," and Forgot password sends them the confirmation email instead of a code. Signed in, they're still a Guest.

Someone your district doesn't have yet can also make themselves a Guest: on your own sign-in page, after Google or Microsoft confirms their email, they select Continue as a guest (when Guest accounts is on). Guests sign in with Google or Microsoft, an emailed sign-in link, or a password of their own (Sign in to schoolOS).

When a Guest becomes one of your people#

A Guest becomes a real person, keeping their tickets, when your district says who they are. Any of these takes over the Guest with the role it gives, instead of adding someone twice:

• adding them on Admin › People › Users with the same email,
• an import with their email,
• a roster (SIS) sync, matched by their email when nothing else matches,
• a Google or Microsoft directory sync with their email,
• or giving them another role on their profile.

For example, a parent emails the helpdesk from their gmail.com address about a broken Chromebook before the SIS sync has brought families in. They're a Guest, and get the agent's replies by email. That night the roster sync brings the parent in as a Guardian: the same record, now with their student's requests and devices.

Delete a role#

Built-in roles can't be deleted. To delete one of your own:

1. Give everyone who has it another role first. Delete stays off while anyone has the role.
2. Open the role and select Delete, or use Delete in its row's … menu.

The role is deleted once you confirm. It can't be brought back, so make it again if you need it. Your audit log records the deletion.

School roles#

The School roles tab. A school role is a person's job at the school, like Teacher, Librarian or Counselor. It says who someone is, not what they can do in schoolOS: a Counselor and a Teacher can both have the Staff role. Knowledge and agent routes can be aimed at a school role.

• New school role opens a dialog: type its name and select Add school role. You need Add people, Update people, Manage knowledge or Manage the agent.
• The count, or See the people in the row's … menu, opens the people who have it on Admin › People › Users.
• Remove, in the row's … menu, removes one of your own once you confirm. It appears only for school roles nobody has, and only if you can Update people. Built in school roles belong to every account and can't be removed.
• Search school roles... finds one by name, and the Kind filter shows only Built in ones or Your account's.

Give someone a role#

Roles are given on each person's profile, not on this page.

1. Open the person from Admin › People › Users.
2. On the School tab, pick their schoolOS role.
3. Save.

To change someone's role, you need Update people and Assign roles. You can't change your own role. Which built-in roles you can give depends on your own role. You can give a role of your own only if your role ranks at least as high as what it's treated as, so a Super Admin can give any of them. Importing people offers the same roles.

Someone whose role sees Their teams' needs a team: put them on it from the team's page or their profile. A person has one Location; the other schools they look after come from their teams' coverage. How reach works.

An import can set roles for many people at once, from a schoolOS Role column.