/settings/roles) and the role change history at /settings/roles/audit. Only administrators can reach this area.
Custom roles are additive. Assigning one adds permission keys to what a user already has through their built-in role. It never replaces or downgrades a built-in role.
Built-in roles
Every built-in role is mirrored as a seeded, immutable system role so its exact grants show up in the same list as custom roles.| Role | What it can access |
|---|---|
| Administrator | Every permission key in the catalog. |
| Supervisor | View, create, edit, and delete students; assign PACEs; view and set Goal Check targets; mark completion; view and submit grading; mark and view attendance; view calendar and create centre events; view and generate reports; view and check out inventory. |
| Monitor | Same as supervisor, minus deleting students, creating centre calendar events, and inventory access. |
| Student | View Goal Check progress and view the calendar. |
| Parent | View the calendar. |
The permission catalog
Custom roles are built from a fixed catalog of permission keys, grouped by area: Students, Goal Check, Grading, Attendance, Calendar, Reports, Settings, Roles & Permissions, and Inventory. Each key controls one specific action, such as viewing student records, marking attendance, or generating reports. For the full list of permission keys and what each one unlocks, see the role and permission reference.Managing custom roles
Open Settings > Roles
Go to Settings > Roles. The list shows every role in your organization: its name, description, a System badge for the built-in role mirrors, how many permissions it grants, and how many members hold it.
Create, clone, or edit a role
Click New role to start from scratch, or Clone an existing role including a system role to make a customizable copy of it. Name the role, add a description, and check the exact permission keys to grant. System roles themselves cannot be renamed or edited directly.
Assign the role to a user
Open a user’s detail page under Settings > Users and add the custom role under Assigned Roles. You can also bulk-assign or bulk-remove a role across many users at once from the Roles page.
Check effective permissions
On the user’s detail page, the Effective Permissions card shows the resolved union of their built-in role and any assigned custom roles, with each key attributed to the role that granted it.
Role change history
Settings > Roles includes a link to the audit log at/settings/roles/audit. It records every role and permission change made in the organization: who made the change, what changed, and when. The log is paginated with a Load more control and can be filtered by actor.
Teaching staff and user accounts
Invite staff, assign centres, and deactivate or reactivate accounts.
Learning centres
How centres scope which students and staff a role can see.
Role and permission reference
The full permission catalog and system role bundles.
Terminology
Definitions of roles, centres, and other Zion-specific terms.