The 18 roles explained: who can do what

School Vault uses 18 distinct roles to control who can see and do what across the platform. This article explains each role, the access level it carries, and when to assign it, so you build a permission structure that is both safe and practical.

Before you begin

  • You have admin access to your School Vault account.
  • You understand the difference between a role (a permission profile) and a staff member (a person who holds one role).

How roles work

Every School Vault user has exactly one role. That role determines:

  • Which menu items they can see in the navigation
  • Which records they can read, create, edit, or delete
  • Whether they are scoped to a specific class (classroom-scoped roles) or can see the whole school (school-wide roles)

Roles cannot be combined. If someone needs capabilities from two roles, for example, a teacher who also handles some admin tasks, consider whether you can use a slightly higher role or whether a second account is the safer approach.

JWT authentication. Every role is enforced server-side using JSON Web Tokens. Changing a URL or guessing an endpoint does not bypass role restrictions, the server rejects requests that do not match the caller's role.

School-level roles (full school access)

1. School Owner

The highest-privilege role. Typically the proprietor or proprietress. Can see everything across all branches, manage the subscription, and access financial summaries. There is usually only one School Owner per account.

2. School Admin

Day-to-day operations role. Can manage staff, classes, students, settings, curriculum, fees, and reports. Cannot change the subscription or billing method, that is reserved for the School Owner.

3. Principal / Head Teacher

Read access across all classes and reports. Can review attendance analytics, assessment progress, and generate reports, but cannot change settings, invite staff, or edit fee structures. Ideal for a head teacher who monitors without managing.

4. Vice Principal

Similar to Principal but with the additional ability to manage attendance exceptions and approve late-arrival notes. Cannot change settings.

5. Registrar

Manages student enrolment, promotions, and transfers. Can add, edit, and archive student records. Cannot access health records or financial data.

6. Bursar / Finance Officer

Full access to all financial features: fee templates, billing, payment records, DVA management, Paystack reconciliation, and financial reports. Cannot access health records, incident reports, or assessment data.

7. Office Staff / Secretary

Administrative support role. Can manage the student register, attendance, authorised pickups, and general communications. Read-only access to health records. Cannot manage fees or curriculum.

8. Curriculum Lead / Academic Coordinator

Full access to the Curriculum Centre, assessment models, Learning Journals, and portfolio generation. Can assign and archive curricula. Cannot manage fees or staff.

Classroom-scoped roles (own class only)

These roles can only see students assigned to their class sections. They cannot browse other classes.

9. Class Teacher

The core teaching role. Can take attendance, write daily reports, log observations, record wellness and health entries, create Learning Journal entries, enter marks (primary), and send messages to their class parents. This is the role you will assign to most teaching staff.

10. Assistant Teacher

Same as Class Teacher except cannot publish report cards or generate PDFs, they can draft but must hand off to the Class Teacher or Admin for publication.

11. Key Person

Early-years specific. Same capabilities as Class Teacher but with an additional view showing the individual care plans and special notes for their named key children. Designed for EYFS and British-Nigerian Hybrid settings.

12. Subject Teacher (Primary)

Can enter marks and view assessment data for the specific subject(s) assigned to them. Cannot take attendance, write daily reports, or access health records.

13. Form Teacher (Primary)

Takes attendance and writes class-level notes. Can view marks across all subjects for their form class but cannot enter marks (that is the Subject Teacher's domain).

Support roles

14. School Nurse / Health Officer

Full access to health records, wellness tracker, and medication logs for all students in the school. Can log checkups, vaccinations, illness episodes, and injuries. Cannot access financial data or assessment records.

15. Security / Gate Officer

Narrow, focused role. Can view the student register, check the authorised pickup list, and mark a student as checked out. Cannot see any other records. Designed for the school gate.

16. Driver / Transport Staff

Can view the student roster for bus routes and mark students as on-bus or dropped off. Cannot see health, financial, or assessment data.

Parent and guardian roles

17. Parent / Guardian

The parent portal role. Can only see records for their own children: daily reports, Learning Journal entries, attendance summaries, homework assignments, and fee statements. Cannot see other children's data under any circumstances.

18. Visitor / Observer

Read-only access to a limited set of school-wide information (e.g. a regulator or inspector who has been given temporary access). Cannot create, edit, or delete any records.

Role assignment dropdown showing all 18 roles with brief descriptions on hover

Choosing the right role

Follow this decision guide:

  • Need full school control? → School Admin (not School Owner unless they are the proprietor)
  • Teaches a class? → Class Teacher or Key Person (early years)
  • Teaches a single subject in primary? → Subject Teacher
  • Handles money? → Bursar
  • Handles health matters? → School Nurse
  • Sits at the gate? → Security / Gate Officer
  • Parent of a student? → Parent / Guardian
Principle of least privilege. Always assign the lowest role that allows the person to do their job. This minimises the risk of accidental data exposure or accidental edits to records outside their responsibility.

Common mistakes

  • Assigning School Admin to every senior staff member "to keep things simple", this gives teachers, bursars, and nurses access to each other's data unnecessarily.
  • Confusing the Principal role (read-only oversight) with School Admin (full write access).
  • Using the Visitor role for long-term staff, it is designed for temporary observers, not people who need to create records.
  • Giving a Subject Teacher the Class Teacher role, Subject Teachers can then take attendance and see health records they should not access.
Version history
v1.0 23 Jul 2026 Article published for Academy v1.0.