Permissions

Configure permission nodes.

Permission Hierarchy

Permissions organized hierarchically:

Root
├── Academic
│   ├── Courses (View/Edit)
│   ├── Sections (View/Edit)
│   └── Grades (View/Edit)
├── Registration
│   ├── Enrollments
│   └── Holds
└── Administration
    ├── Users
    └── Settings

Node Types

Type	Description
Menu	Navigation access
Screen	Page access
Tab	Tab within screen
Field	Individual field
Action	Button/operation

Access Levels

Level	Meaning
None	No access
View	Read-only
Edit	Full access

Tab Nodes

A Tab node is the switch for one tab of a tabbed screen, such as the Enrollments or Notes tab on a student record. A tab is shown only when the acting role has both:

1. at least View on the tab's own Tab node, and
2. at least View on every node the tab's data comes from.

The Tab node is the switch you use to hide a tab from a role. The data nodes are what the server checks when the tab loads, so they decide whether the tab could work at all. Before October 2026 many tabs checked only the Tab node, or nothing, and a role without the data node saw a tab whose every request was refused. The page swallowed the refusal and showed an empty table: registrars without GRADUATION.* saw "no records" on the Graduation tab of students who had in fact graduated. Now such a role does not see the tab, and a tab that does show but fails to load says so instead of looking empty.

Whether a tab shows is decided by the role, not by the student. Which students' data it returns is still the grant's scope, applied by the server: an advisor whose grant is scoped to their advisees gets data only for their advisees.

Student record tabs

Every STUDENTS.TAB.* node is a child of STUDENTS.SEARCH, so a role granted the student record with Include children gets all of them without further rows; set a tab's node to None for a role to hide that tab.

Tab	Tab node	Also needs
Enrollments	STUDENTS.TAB.ENROLLMENTS	REGISTRATION
Majors & Minors	STUDENTS.TAB.MAJORS_MINORS
Advisors	STUDENTS.TAB.ADVISORS	ADVISING.ADVISORS
Campuses	STUDENTS.TAB.CAMPUSES	ADMIN.CAMPUS_ASSIGNMENTS
Contact Info	STUDENTS.TAB.CONTACT	PEOPLE.VIEW
Demographics	STUDENTS.TAB.DEMOGRAPHICS	PEOPLE.VIEW
International	STUDENTS.TAB.INTERNATIONAL	PEOPLE.VIEW; shown only for international students
History	STUDENTS.TAB.HISTORY	REGISTRATION
Test Scores	STUDENTS.TAB.TEST_SCORES
Cohorts	STUDENTS.TAB.COHORTS
Communications	(none)	COMMUNICATIONS.STUDENT_HISTORY
Notes	STUDENTS.TAB.NOTES
Status History	STUDENTS.TAB.STATUS_HISTORY
Graduation	STUDENTS.TAB.GRADUATION	GRADUATION.RECORDS. Its applications list also needs GRADUATION.APPLICATIONS
Relationships	STUDENTS.TAB.RELATIONSHIPS	PEOPLE.TAB.RELATIONSHIPS
Proxy Access	STUDENTS.TAB.PROXY_ACCESS	PROXY.MANAGE

Campuses, Status History, Graduation, Relationships and Proxy Access had no Tab node until migration 302 added them. Each was granted exactly as the role's Enrollments tab already was, so no role lost a tab it could use; roles lost only tabs whose data they could not read. (Registrars then lost the Campuses tab until migration 303 gave them ADMIN.CAMPUS_ASSIGNMENTS.)

Person record tabs

Tab	Tab node
Roles	PEOPLE.TAB.ROLES
Contact Info	PEOPLE.TAB.CONTACT
Demographics	PEOPLE.TAB.DEMOGRAPHICS
Admissions (test scores)	ADMISSIONS.TEST_SCORES
Relationships	PEOPLE.TAB.RELATIONSHIPS
International	PEOPLE.TAB.INTERNATIONAL; shown only for international people

All of their data is read under PEOPLE.VIEW, which opening the person record already requires. A role whose PEOPLE.VIEW grant is scoped sees a directory card for the person instead, with no tabs.

Other tabbed screens

The same rule applies to the other tabbed screens, including the degree audit, course, requirement block and degree screens, student billing, hold types, organization, role networks, student lists and the GPA calculator. On the GPA calculator, for example, the Student GPA Lookup tab needs GPA.TAB.LOOKUP and STUDENTS.SEARCH, while the What-If GPA Calculator tab needs only GPA.TAB.WHAT_IF. Students hold GRADING.GPA and GPA.TAB.WHAT_IF at View with SELF scope (migration 304), so they can project their own GPA but cannot look anyone up.

Checking a role

To see what a role will get, switch to it (or impersonate a user who holds it) and open a record. A missing tab means the role lacks the Tab node or one of its data nodes.

Creating Nodes

1. Navigate to Admin > Permission Nodes
2. View tree structure
3. Add nodes as needed

Assigning to Roles

1. Go to role
2. Add permission nodes
3. Set access level
4. Optionally include children

Inheritance

Child nodes inherit parent settings:

• Unless explicitly overridden
• Can restrict but not expand

Audit Log

All permission changes logged:

• Who changed
• What changed
• When changed