Roles

Configure user roles.

The roles that exist

Code	Name
SUPER_ADMIN	Super Administrator
REGISTRAR	Registrar
RECORDS_OFFICE	Records Office
ACADEMIC_ADMIN	Academic Administrator
ADVISOR	Advisor
FACULTY	Faculty
STUDENT	Student
ADMITTED_STUDENT	Admitted Student (assigned dynamically)
FINANCIAL_ADMIN	Financial Administrator
STUDENT_FINANCE_DIRECTOR	Director of Student Finance
Cashier	Cashier
STUDENT_LIFE_OFFICE	Student & Spiritual Life Office
ACA_COORDINATOR	Campus ACA Coordinator
ACA_ADMISSIONS_LIAISON	ACA Admissions Liaison

There is no built-in "Administrator", "Admissions Staff" or "Department Admin" role. Leading a department is not a role at all — it is an appointment, recorded as a unit administrator, which then derives ACADEMIC_ADMIN for that person automatically.

Superuser is a property of the role, not of the user

SUPER_ADMIN is the only role with grants_superuser set. Holding it is not enough to exercise superuser powers: the check is the user flag and the role they are currently wearing. A superuser who switches to Academic Administrator is evaluated as an Academic Administrator by the API, not merely in the menu.

That is the point of the design — people hold several roles precisely so they can see what each one can do. Before it worked this way, switching role changed the menu but not what the API would allow, which made the switcher untrustworthy for testing access.

One deliberate exception: "stop impersonating" stays reachable regardless of the acting role, so nobody can strand themselves inside an impersonation session.

Creating Roles

1. Navigate to Admin > Roles
2. Click Add Role
3. Configure:

Field	Description
Role Code	Identifier, such as DEPARTMENT_HEAD. Permission Transfer matches roles between databases on it
Name	Display name
Description	Role purpose
Type	System, Manual or Auto-Derived
Priority	Lower is higher. Decides which role a user acts under when they have not chosen one, and which role they fall back to when their chosen one is not usable from their network. New roles default to 100
Idle timeout (minutes)	Optional, minimum 5. Signs users out sooner than the system Session Timeout while this is their acting role. Leave blank to use the system value. A value longer than the system timeout has no effect: a role can only shorten it
Active	Inactive roles are not offered

The Idle Timeout column shows each role's limit, or System default. The limit follows the role a user is acting as: switching to a role with a shorter limit tightens the session at once, and switching back restores it. It is not applied while impersonating; the session belongs to the administrator. See Environment Configuration for how it combines with the server's own ceiling.

Give a new role a network rule

Under role network enforcement, a role with no ALLOW network cannot be used from anywhere. When you create a role, add its rules on Role Networks.

Role Assignment

Manual Assignment

1. Go to user account
2. Add role with dates
3. User has role permissions

Auto-Derived

Roles assigned automatically:

• Student role when registered
• Faculty role when teaching
• Based on system actions

Role Permissions

Assign permissions to role:

1. Open role
2. Go to Permissions tab
3. Add permission nodes
4. Set access level (View/Edit)

Role Switching

Users with several roles choose which one to act as from the role switcher.

• The acting role decides everything. The menu, which screens open, and what the API allows all follow the permission nodes granted to the acting role. A screen in the menu is a screen the role can open. (Until October 2026 some screens also checked legacy account flags that role assignment never maintained, so a registrar assigned through roles could see Reports in the menu and be refused on every click.)
• Only current roles are offered. A role assignment outside its effective and expiration dates is not listed, and is never chosen as a fallback.
• Roles unavailable from this network are disabled. If Role Networks does not permit a role from the user's address, the switcher shows it disabled and refuses a switch to it. When the user's chosen role is unavailable, they act under their highest-priority available role until they return to an allowed network, and a banner says so.
• The idle timeout follows the role, as described above.
• Activity is recorded against the person, and the audit trail notes impersonation.