Roles & Permissions
A role is a named set of permissions, such as Teacher or Reports officer. You give each member of staff one or more roles. A permission is one thing a person may do, such as enter marks or publish a report. This page explains how roles work and how to set them up. Open it from Configuration → Users & Roles.
Who sets this up
Your school's MarkBook administrator does. In MarkBook, a school manager is the administrator and has everything open from the start. Other staff can open Users & Roles only if you give them the permission Users and roles. Treat that permission with care: it can grant every other permission.
Three questions, three places
Access in MarkBook answers three separate questions. One never replaces another.
| Question | Where it is decided |
|---|---|
| May this person open MarkBook at all? | Kinderpedia, in the school's module settings |
| Whose markbooks does this person reach? | Their own markbooks, the ones they lead (Leadership Roles), and subjects they are allocated to on a template |
| What may they do with those markbooks? | Their roles, on this page |
Example: A teacher with a role that includes Enter and change marks can write marks only in markbooks they reach. A head of department with a role that lacks that permission can see their department's markbooks but cannot change a mark.
Before you install roles: nothing is enforced
A school that has never installed roles has no restrictions from permissions. Everybody can do everything MarkBook allows for their account type. The one exception is configuration: only managers and people with full access open the Configuration area until roles exist.
A banner on the Users tab tells you which state you are in: "Permissions are not enforced yet" or "Permissions are enforced (roles installed …)".
WARNING
Installing the default roles is the switch that turns enforcement on. From that moment, every member of staff gets the default role, Teacher, unless you give them another. Install the roles, then check the Users tab straight away.
Install the default roles
- Open Configuration → Users & Roles → Roles.
- Press Install default roles.
- Read the warning "Turn permission enforcement on?" and press Confirm.
MarkBook creates five roles:
| Role | For | Highlights |
|---|---|---|
| Administrator | Whoever runs MarkBook | Everything. Cannot be reduced or renamed. |
| Teacher (default) | Class teachers | View and enter marks, bulk entry, cell history, summary, write comments, use the comment assistant, view attendance, create, edit and submit reports |
| Senior teacher | Heads of department and similar | A teacher's rights, plus set targets, restore marks, export and import marks, curate the comment bank, review and approve reports, view analytics |
| Reports officer | Whoever runs the reporting cycle | Read-only grades, plus create, review, approve and publish reports, bulk actions, manage report templates |
| Observer | Governors, inspectors | Read grades, summary, comments, attendance, reports and analytics. Changes and exports nothing. |
You can edit any role except Administrator. Pressing Install default roles a second time is safe: it adds what is missing.
Senior teacher is not Head of department
Senior teacher is a permission role: it says what a person may do. Head of department is a leadership assignment: it says whose markbooks a person reaches. They are separate. Give a head of department both: the Senior teacher role and a leadership assignment for their subject. See Leadership Roles.
Create or edit a role
- Open Configuration → Users & Roles → Roles.
- Press New role, or open an existing role.
- Fill in Name, Description and Colour.
- Switch Default role on if this role should apply to everyone with no role. Only one role is the default.
- Save.
The permission matrix
Open Configuration → Users & Roles → Permissions. The matrix has one row per permission and one column per role. Tick the boxes you want.
Permissions are grouped in sections.
| Section | Permissions |
|---|---|
| Dashboard | Open the module (always on) |
| Grades | View the marks grid, Enter and change marks, Set target grades, Fill in bulk, See a cell's history, Restore an earlier mark, Export the grid, Import marks |
| Summary | View the summary, Export the summary |
| Comments | Read teacher comments, Write teacher comments, Use the comment assistant, Curate the comment bank |
| Attendance | View attendance |
| Course plans | Write course plans |
| Reports | View reports, Create reports, Edit reports, Submit for approval, Open the review queue, Approve or request changes, Publish to parents, Unpublish, Delete reports, Bulk generate and publish, Download the PDF, Manage report templates, Manage approval workflows |
| Analytics | View analytics, Export analytics |
| Configuration | Academic years and periods, Lock and unlock periods, Grade and assessment scales, Subjects, Value types, Markbook templates, Student targets, Rubrics and standards, Module settings, Assign leadership roles, Users and roles, Developer: API keys and webhooks |
| Students | Student flags |
Some rows have a badge for sensitive permissions. These send data out of the building (exports, imports), tell families something (publish, unpublish), or overwrite or freeze other people's work (restore, lock a period, Users and roles). Give them to few people.
Open the module is ticked and greyed out for every role. It cannot be taken away, so every person who has access can at least open the dashboard.
Assign roles to people
- Open Configuration → Users & Roles → Users.
- Find the person. You can search by name or filter by role.
- Press Change roles.
- Tick the roles and press Save.
A person with several roles gets everything all their roles grant. People with no role get the default role. The same panel shows and edits their leadership assignments, so you handle one person in one place.
What roles never change
- Managers and full-access users always hold every permission. This is how the first administrator can reach Users & Roles before any role exists.
- Parents and students never use these roles. What they may do is set on Parents & Students. See Family Permissions.
- A permission does not override the state of a cell. A locked period, an approved column or a published report still refuses changes.
TIP
Start with the defaults. Move teachers to Teacher, heads of department to Senior teacher, and the person who runs reports to Reports officer. Change single permissions only when a real need appears.
Seeing what happened
Changes to roles, permissions and assignments are written to the activity log, under Configuration → Activity log.
Was this helpful?