Who sees what

Everyone in your district sees only what they need. schoolOS decides that the same way every time, whether someone opens a page, searches, runs a report or asks an AI assistant. This explains how, so you can set up roles and teams with confidence and answer "why can't I see this?"

Three checks#

Before showing anyone anything, schoolOS asks three questions. The answer has to be yes to all three.

1. Does your account have the product? That's your plan.
2. Can their role do this? That's the role's permissions.
3. Is this record within their reach? That's what their role sees of tickets, assets and tasks: their own, their teams', or all.

The checks are separate. A permission can't make up for a product your account doesn't have, and a product doesn't give anyone access their role doesn't allow.

Your plan#

Your plan decides which products your account has: schoolAssets, schoolHelpdesk, schoolAgent and schoolAutomate. A product you don't have is hidden from everyone, including your Super Admins.

In the role editor, areas for products you don't have are grayed out. A role can still hold permissions there. They do nothing until your account has the product.

Permissions#

A role's permissions decide what people can do: open a page, see a record, change it, delete it. You set them on Admin › People › Roles, as a level for each area. What each level allows.

A page opens only when all of these are true:

• your account has its product;
• the role holds its permission;
• the page above it opens too.

So turning off Assets also turns off everything under it, like Check-in/out.

Reach#

Reach decides which records someone sees, once they're allowed to see that kind of record. Nobody in your account ever sees another account's records. Within your account, each role has one setting per area.

What they see: Own, Their teams' or All#

Each role sees Tickets, Assets and Tasks at one of three levels, and Assets has a fourth, Own and their rooms. Parts, Check-in/out and Audits follow Assets.

| Level | Tickets | Assets | Tasks | | --- | --- | --- | --- | | Own | Tickets they asked for, are assigned, follow, or were let in on. | Assets at their location, or assigned to them. | Tasks assigned to them, made by them, or with a step for them. | | Own and their rooms | Not offered: tickets have no room. | Assets assigned to them, and devices in or assigned to their rooms. Nothing else at their school. | Not offered: tasks have no room. | | Their teams' | Their own, plus tickets in their teams' queues and tickets at any location their teams cover. | Their own, plus assets at any location their teams cover. | Their own, plus tasks assigned to their teams, tasks on tickets they see, and tasks at any location their teams cover. | | All | Every ticket. | Every asset. | Every task. |

The built-in roles start here:

| Role | Tickets, assets and tasks | | --- | --- | | Super Admin | All, in every department. It can't be changed. | | Agent | All, in the departments they belong to. Your account can change it. | | Staff, Student and Guardian | Own. A guardian also sees their students' requests and devices. | | A role of your own | What you pick in the role editor. |

Teams cover locations#

A person has exactly one location: the Location on their profile. The other schools they look after come from their teams. Each team covers some locations, set under Coverage on the team's page (how):

• Its members' locations (every team starts here): wherever the people on the team are based.
• Chosen locations: the ones you pick, like the five schools in a zone.
• All locations: every location in your account.

A school can be covered by several teams. Coverage takes effect for everyone on the team on their next page: add a school to a team, and all its members see that school's tickets, assets and tasks; take it off, and they don't.

For example, a district splits its schools into zones. Zone 1 covers five schools. A tech on the Zone 1 team, whose role sees Their teams' tickets, assets and tasks, sees what's at those five schools, plus Zone 1's queue. When the district moves Lincoln Elementary to Zone 2, the Zone 2 techs see Lincoln at once and the Zone 1 techs no longer do.

Where, by location#

Outside tickets, assets and tasks (the people list, location pickers, dashboards), a role whose areas are all at Own or Their teams' reaches only the person's locations: their own, and the ones their teams cover. A role with any area at All reaches every location. Someone limited to their locations sees records at those locations and nothing else. Their district is never used as a fallback.

For example, a guardian with two students, one at Lincoln Elementary and one at Jefferson Middle, sees both students' requests and devices, even though a guardian has no location.

The default location#

Every account has a default location. It catches people and assets that arrive without one, so nobody ends up reaching nothing by accident.

• People. Anyone added without a location goes to the default location: added by hand, imported, rostered, approved, or on first sign-in. The main exception: when the person adding them can't see the default location themselves, it isn't used.
• Assets. An asset added without a location goes to the default location. If the person adding it can't see the default location, it goes to their home location instead, so it doesn't vanish from their view.

Check who landed at the default location now and then, and move them to their real school.

Tickets#

Their teams' tickets are both a team's queue and its covered locations. A ticket in Zone 1's queue shows to the Zone 1 techs even when it's at a school Zone 1 doesn't cover; a ticket at a Zone 1 school shows to them whichever team's queue it's in. Moving someone to another team changes which tickets they see, without touching their role.

Assets#

The same levels apply on the asset list and search, an asset's page and history, parts stock, Check-in/out and Audits. Own is the assets at their school and the ones assigned to them, so a teacher with Own sees every device at their school, their own laptop included. Own and their rooms narrows that to what's theirs and what's in their rooms: a teacher in room 104 sees the projector in 104 and their own laptop, and nothing else at the school. Give people their rooms on their profile or with the people import's Rooms column. Super Admins always see every asset in your account.

Tasks#

A task on a ticket shows to anyone who sees the ticket, when their tasks are at Their teams'. Whatever the level, the people a task or a checklist step is given to always see their own work.

Departments#

When your account uses departments, each role also says whether it stops at the departments a person belongs to. Agent does: an HVAC tech in Facilities sees work orders, not Chromebook repairs. Someone in no department works in IT and Facilities. A role that reaches Every department isn't held to membership. Super Admins always reach every department. Departments work on top of the level, so a Facilities tech whose teams cover Lincoln Elementary sees Lincoln's work orders, not its IT tickets.

Work can still be handed across. From a ticket you hold, a child ticket or a task can go to any department that's turned on, whether or not you're in it, and that department's people work it. A ticket's linked tickets (its parent and the tickets above it, its child tickets and theirs, or the one it was merged into) in a department you don't work in show their number and department, with the subject hidden.

A child ticket's requester is the agent who created it, so the person who asked for the original work doesn't see it. An agent can let them: Let [requester] see this ticket when creating the child ticket, or the switch on its row in Linked tickets. They're added as a CC, so they see its status and public replies (never internal notes), even when it's in a department they have no part in, and their own ticket lists the child tickets they can follow. Turning the switch off takes that away. It's never offered on a private or FERPA-protected ticket. Insights' Department Moves shows a department's members the tickets that moved into or out of their departments.

Private tickets#

A ticket in a private topic opens only to the people, teams and roles on that topic's access list, its requester, its assignee and anyone let in on the ticket, whatever the role's reach. Covering a school, owning the ticket's team or holding a role that sees every department never opens it. It stays private if it moves to another topic.

Outside the ticket, its messages stay hidden too: lists and search show its subject with "Private ticket" in place of a preview, notifications and follower emails say only "There's an update on a private ticket", and Otto names who replied and when, never what they wrote.

Their own requests and assets#

Whatever their role and reach, everyone who signs in can open My tickets and My assets. And everyone always sees a ticket they asked for, are assigned to, follow, are CC'd on, or hold a task on, even outside their reach. Your settings never hide someone's own work from them.

schoolOS staff#

schoolOS's own support staff aren't limited by your plan, your roles or your reach, so they can help when something's wrong. There are two kinds: schoolOS Super Admin can make changes, and schoolOS Admin can only look. Neither role can be given to anyone in your account.

Why can't someone see something?#

Work through the three checks, in order:

1. The product. Is it in your plan? If the area is grayed out in the role editor, it isn't.
2. The permission. Open their role on Admin › People › Roles. Is the area at the level they need, and is the page turned on under Where they can go?
3. The reach. Is the area at Own, Own and their rooms (assets only), Their teams' or All? If it's Own and their rooms: is the device in, or assigned to, one of their rooms? If it's Their teams': are they on a team, and does that team cover the record's location? Check their Location, Rooms, departments and teams on their profile (the Where they reach card gathers them), and the team's Coverage.

For example, a Facilities agent says they can't see a work order for a leaking roof at the high school:

1. The product. Your account has schoolHelpdesk, so work orders are in the plan.
2. The permission. Their role has Tickets at Edit, so they can work tickets.
3. The reach. Their role sees Their teams' tickets, and they're on the "North Maintenance" team, which covers only the middle school. Add the high school to North Maintenance's Coverage, and the work order appears for the whole team.