Administration
People & Access
Who holds accessStudents get the Student role when they're enrolled and teachers the Teaching staff role when they're listed on a class or given a role that runs one — you don't give those by hand. Who holds a role on one class, program or folder (Teacher, Manager, …) is on its Settings; what those roles carry is under Class & program roles. The admin portal administers these same roles and grants; access it keeps in step with its staff roster is marked with a lock and changes there.
Everyone with a role or permission in the LMS, most access first. Changes apply at once.
Nobody holds this access yet.
RolesEditing a role changes what everyone holding it may do, straight away. The super admin role always holds everything; built-in roles can be edited but not deleted. You can only add permissions you hold yourself. Teaching staff is not a class's Teacher: it holds the permissions teachers use, and they count only on classes the person teaches, for the parts that class's Teacher role allows. Class, program and folder roles are under Class & program roles.
Bundles of permissions people hold instead of collecting them one by one.
- LMS super adminBuilt-in1 person
Unrestricted access to everything in the LMS.
Everything - LMS administratorBuilt-in0 people
Runs the LMS: classes, enrollment, attendance, courses, programs, scheduling and API keys, and can preview the portal as a role or person.
All of LMSPreview AsView access control - Teaching staffBuilt-in0 people
The permissions teachers use — attendance, rosters, materials and grades, announcements, offering courses, interview outcomes. Given automatically to anyone who teaches a class or holds a role that runs one. On its own it opens no class: it counts only on classes the person teaches, for the parts the class's Teacher role (or their role there) allows.
View my learningView classesView rostersManage rosters of classes you teachView attendanceRecord attendanceImport Zoom attendanceAdd students' other emailsManage class materialsRecord interview outcomes - Payment managerBuilt-in0 people
Works the Finance dashboard: confirms bank transfers and Zelle receipts, marks tuition paid, issues enrolment codes, marks refunds sent, and reads the collection metrics. Nothing else in the LMS.
View financeConfirm payments - StudentBuilt-in0 people
Sees their own classes, attendance record, the courses they hold, and their programs.
View my learning
Class, program and folder rolesThese roles are held on one class, program or folder, but what each carries is the same everywhere unless a class keeps its own version. Changing them takes the institute's class (or program) management permission. Each still needs the matching permissions above: a class Teacher marks attendance only with Teaching staff's attendance permission.
Teacher, Manager, Faculty and the rest — what each carries on every class, program and folder.
The roles every class has. A change here applies to every class at once, except where a class keeps its own version (made from its Settings). Who holds a role is set on each class’s Settings → Access Control.
- TeacherBuilt-inNot held yet
The people listed as a class's teachers. What they may do on it is this role's list, using the permissions of the institute's Teaching staff role.
Sessions & attendancePeopleMaterials & grades - ManagerBuilt-inNot held yet
Everything a teacher does, plus the class's settings and who holds a role on it.
Sessions & attendancePeopleMaterials & gradesThe class
Teacher here vs. the institute’s Teaching staff role
- Teacher (this role)
- The people listed as this class’s teachers. Its list above is what they may do on this class — the same on every class unless a class keeps its own version.
- Teaching staff (People & Access → Access Control)
- An institute role holding the permissions behind running a class — marking attendance, managing a roster, posting materials and grades. It is given automatically to anyone who teaches a class or holds a role that runs one. On its own it opens no class: it only counts on classes the person teaches.
So a teacher may do something on a class only when this class’s role allows that part and Teaching staff holds the permission for it.
What each permission allowsPermissions are declared in the LMS's code (src/lib/alfiz/catalog.ts) and checked at build time; adding one is a code change. Only LMS permissions exist here — the admin portal's are administered there.
The LMS's permission catalog. A group's wildcard covers everything in it, now and later.
Access control › People and roles4
- Edit roles
alfiz_internal.access.manage_roles - Create, edit and delete the LMS's roles — never adding a permission you don't hold yourself.
- Give and take away access
alfiz_internal.access.manage_grants - Give people roles and permissions in the LMS, and take them away — never more than you hold yourself.
- Preview As
alfiz_internal.access.view_as - See the portal as a role or a person would (Institute Settings → Preview As). A preview only narrows.
- View access control
alfiz_internal.access.read - Open People & Access → Access Control: who holds which role, the roles and the permission catalog.
Admissions7
- Approve placement groups (legacy)
lms.admissions.approve_groups - Retired: groups are approved on a program's Terms tab, on the term's Groups page (lms.scheduling.manage). Kept so existing grants still parse.
- Configure enrolment forms
lms.admissions.manage_pipelines - Edit a class's or program's enrolment form steps — questions, fee, interview and approval settings — on classes you teach (or everywhere with class management).
- Decide submitted forms
lms.admissions.review - Accept or decline submitted forms in the review queue.
- Record interview outcomes
lms.admissions.record_outcome - Record the outcome of interviews you conducted (interviewers are listed per form; reviewers may record any).
- Run matchmaking (legacy)
lms.admissions.run_matching - Retired: matchmaking now runs from a program's Terms tab, on the term's Groups page (lms.scheduling.manage). Kept so existing grants still parse.
- Send reminders
lms.admissions.send_reminders - Email the people at a chosen stage of an enrolment form — a personalised reminder composed from a template, one message per person, through the org outbox.
- View admissions
lms.admissions.read - See the admissions queue: submitted forms, their answers and interview outcomes.
API keys2
- Manage API keys
lms.api_keys.manage - Issue and revoke API keys and edit the permission grants their service principal holds.
- View API keys
lms.api_keys.read - See issued API keys, their Alfiz permission grants and last-used times (never the secret).
Attendance5
- Add students' other emails
lms.attendance.associate_email - From a session's marking sheet, add another email a student on a class you teach joins Zoom from (or all classes with class management). Every upcoming meeting registers it, and participant reports under it count as them. It never becomes a way to sign in. Held by the Teaching staff role.
- Delete sessions
lms.attendance.delete - Permanently delete an attendance session and its marks.
- Import Zoom attendance
lms.attendance.import - Upload a Zoom participants CSV and commit the parsed minutes onto a session.
- Record attendance
lms.attendance.record - Create sessions and mark students present/late/absent on classes you teach (or all classes with class management).
- View attendance
lms.attendance.read - Read attendance sheets and per-student summaries beyond your own record.
Branding2
- Manage branding
lms.branding.manage - Change this deployment's site name, brand colors and logos. The built-in look is the default; overrides apply portal-wide.
- View branding settings
lms.branding.read - Open the branding page and see this deployment's configured name, color and logo overrides.
Categories2
- Manage categories
lms.categories.manage - Add class categories and languages of instruction to the vocabularies the class editor's dropdowns offer.
- View categories
lms.categories.read - See the class category and language vocabularies. (The class editor's dropdowns ship with class management; this covers the API listings.)
Classes3
- Delete classes
lms.courses.delete - Permanently delete a class with its sessions and enrollments.
- Manage classes
lms.courses.manage - Create and edit classes: title, description, visibility, teachers, attendance threshold, the courses it confers, its program, archive state. Includes the institute's grading presets and the one new classes start with.
- View classes
lms.courses.read - See every class — including private and archived ones — with settings, teachers and enrollment counts. (The public catalog needs no permission.)
Courses3
- Manage courses
lms.credits.manage - Create and edit courses (what a class confers — several classes confer the same one), their codes and prerequisites, and which classes confer them.
- Record courses
lms.credits.award - Record a course as held for eligible students (by attendance) or by hand, and revoke.
- View courses
lms.credits.read - See the course catalogue — codes, prerequisites — and who holds each course.
Enrollment3
- Manage enrollment
lms.enrollment.manage - Enrol people into classes (including pre-auth registry people by email), withdraw them, mark completions, and issue or revoke the one-time enrolment codes that settle payments made outside Stripe.
- Manage rosters of classes you teach
lms.enrollment.manage_roster - Add people to the classes you teach (from the registry, by email or from a CSV), withdraw them, and place them in the class's groups. Scoped to your own classes; the institute-wide enrolment codes ledger stays with enrollment management. Held by the Teaching staff role.
- View rosters
lms.enrollment.read - See class rosters and any person's enrollments.
Finance2
- Confirm payments
lms.finance.manage - Approve or send back uploaded receipts, mark tuition transfers paid or cancel them, issue and revoke enrolment codes, and mark refunds sent — the Payment manager's work, from the Finance dashboard or anywhere a payment is confirmed.
- View finance
lms.finance.read - Open the Finance dashboard: what is waiting to be confirmed, every payment made through the portal (card, bank transfer, Zelle, enrolment codes), refunds, the enrolment-code ledger, and the collection metrics.
Materials2
- Manage class materials
lms.materials.manage - Add, reorder and remove a class's materials — uploaded files and quizzes — on classes you teach (or all classes with class management). Includes posting class announcements (emailed to its students), the class's grading scheme, its certificate, marking hand-graded quiz answers, and the org-wide Question Bank.
- View any class's materials
lms.materials.read - Open and download the materials of any class, including ones you neither teach nor are enrolled on. (Students and teachers reach their own classes' materials through the class itself.)
My learning1
- View my learning
lms.self.read - See your own classes, your own attendance record, the courses you hold, your programs and their registration.
People4
- Export people
lms.people.export - Download every person in the registry as a CSV sheet — names, emails and contact details.
- Manage people
lms.people.manage - Add people by hand and correct their name, email and contact details. Changing an email changes where every message to them goes.
- Merge duplicate people
lms.people.merge_records - Work the Duplicates queue: fold one person's record into another's (the merged-away record is archived) and dismiss conflicts the registry recorded.
- View people
lms.people.read - Open People: search everyone in the registry and see a person's record — contact details, whether they can sign in, and what links them to the portal.
Programs3
- Delete programs
lms.programs.delete - Delete a program outright. Classes restricted to it stand alone again; in-flight submissions block it.
- Manage programs
lms.programs.manage - Create and edit programs — requirements, admission policy, cohorts, groups, faculty, certificate — and admit, move or withdraw members.
- View programs
lms.programs.read - See program definitions, their requirements, cohorts, members and each member's progress.
Scheduling2
- Manage calendars and scheduling
lms.scheduling.manage - Create and edit calendars (under Institute Settings → Calendars, or inline from a program), open and move terms, add registrations by hand, run matchmaking, and approve or dissolve groups — approval is what spawns a class.
- View calendars and scheduling
lms.scheduling.read - See the institute's calendars (Institute Settings → Calendars), each program's terms (the program's Terms tab), who registered for which course, which teachers offer what, and the proposed and confirmed groups.