This page is the full reference for who can do what in a Lernmark workspace. It starts at the top, with the person who owns the account, and works down through school leadership, specialist officers, teachers, students and parents.
If you only want to invite your first colleagues, start with Roles, staff and access and come back here when you need the detail.
How access is decided
Every person's access is the combination of two things:
- A role: the job they do, such as School admin, Finance officer or Teacher. The role decides which areas they can open and whether they can only look or can also make changes.
- A scope: where the role applies. The same role can cover the whole workspace, one school, one department, or only the classes a teacher is assigned to.
So "School admin of Lycée Bilingue de Buea" and "School admin of Collège Saint Michel" are the same role with two different scopes, and neither can see into the other's school.
Enforced by the platform, not the menu
Permissions are checked on the server for every request. Hiding a button is never the only protection: if someone does not hold the right role and scope, the action is refused even if they find a direct link to it.
The scopes
| Scope | What it covers | Used by |
|---|---|---|
| Workspace | Your whole account: every school you run on Lernmark. | Account admin |
| School | One school, college or training centre. | School admin, Finance officer, HR officer, Student welfare, Payroll roles, Teacher |
| Department | One department inside a school. | Department admin, Teacher |
| Class | A single course a teacher is assigned to teach. | Teacher |
| Self | The person's own studies. | Student |
| Linked child | Only the children the school has linked to this parent. | Parent / guardian |
Your workspace is always sealed off from every other school group on Lernmark. Nothing on this page lets anyone see another organisation's data.
The roles at a glance
| Role | Scope | In one line |
|---|---|---|
| Account admin | Workspace | Owns the account: schools, billing, branding, staff appointments and oversight of everything. |
| School admin | One school | Runs a school day to day: academics, students, exams, timetable, attendance, communications. |
| Department admin | One department | Runs a department's courses, students, attendance, timetable and results. |
| Finance officer | One school | Operates fees and payments: invoices, receipts, adjustments, refunds, scholarships, late fees. |
| HR officer | One school | Keeps staff records: profiles, contracts, qualifications, staff documents and leave. |
| Student welfare | One school | Keeps sensitive student records: guardians, health, discipline, confidential notes, student documents. |
| Payroll preparer | One school | Sets up pay and prepares payroll runs for approval. |
| Payroll approver | One school | Approves payroll runs and posts them to the accounts. |
| Teacher | Their classes | Teaches, takes attendance, publishes course content, enters marks. |
| Student | Themselves | Follows their courses, submits work, sees results, gives anonymous feedback. |
| Parent / guardian | Linked children | Follows a child's progress, attendance, fees and school messages. |
One person can hold several roles at once. The founder of a small school is often the Account admin, the School admin and the Finance officer all at the same time, and simply sees the combined access.
Account admin
The Account admin (also called the tenant administrator) is the owner of the workspace. There is always at least one, and the first one is created when the workspace is opened.
What an Account admin manages
- Schools: add and maintain the schools in the workspace, and choose which one they are currently working in.
- Subscription and billing: see the plan and request an upgrade.
- Workspace settings: operational settings such as the school timezone.
- Branding and letterhead: the brand colour used across the app and the official header printed on timetables, report cards, transcripts and certificates.
- People and roles: invite staff into any role in any school, change their scope, and remove access.
- Parent portal access: invite parents and grant or withdraw their access.
- Activity log: review the workspace's own record of who did what and when.
What an Account admin can see
The Account admin is the workspace's full read authority. They can view every area of every school, including the confidential ones: staff HR records, payroll, and student health, discipline and restricted notes. This is view only. Changes to confidential records stay with the specialist roles described below.
Running a school as the Account admin
When an Account admin selects one of the schools, they can also run that school's day-to-day operations in the same way a School admin would: academics, enrolment, courses, timetable, attendance, admissions, exams and results, teaching content, certificates, library, document library, communications and fees. The authority follows the school they have selected, so switching schools switches what they are acting on.
The primary Account admin is protected
The founding Account admin is marked as primary. Other administrators cannot remove or demote them, only the primary Account admin can hand the primary role to someone else, and the last remaining Account admin can never be removed. A workspace can never be left without an owner.
School admin
A School admin runs one school. If you run several schools, each can have its own School admins, and a School admin of one school has no access to the others.
What a School admin manages, for their school
| Area | What they can do |
|---|---|
| Academic structure | Sessions, terms, departments, programmes, levels and class sections. |
| Students and enrolment | Student profiles, registry imports and enrolments. |
| Courses | The course catalogue, classes for the session, course registrations and teacher assignments. |
| Timetable | Schedule lessons, with clashes checked automatically. |
| Attendance | Record and correct attendance for any class in the school. |
| Admissions | Record applications and move them through review and decision. |
| Teaching and learning | Author and publish course content for any class. |
| Exams and results | Configure grading schemes, sequences and entry windows; enter and validate marks; publish results; amend published results with a new version. |
| Certification | Configure training modules and issue certificates. |
| Library | Catalogue, memberships, lending policy, fines and front-desk lending. |
| Document library | Upload and remove shared school documents such as policies, forms and handbooks. |
| Communications | Publish announcements to a chosen audience and message parents about their child. |
| Teacher evaluation | Build templates, run campaigns, moderate feedback, see cross-teacher analytics and export reports. |
| Parent portal | Invite parents and manage their access. |
| Finance | View invoices, payments and the ledger. |
Appointing colleagues: a School admin can invite further School admins for their own school and Department admins for departments inside it.
What a School admin does not do: billing, adding schools, workspace settings and branding, the activity log, operating fees (see Finance officer), staff HR and payroll records, and sensitive student welfare records. Those belong to the Account admin and the specialist roles.
School admin and money
A School admin can see the school's finances but cannot issue invoices or record payments. If the same person should also run fees, give them the Finance officer role for that school as well. Keeping the two apart means handling money is always a deliberate decision.
Department admin
A Department admin (often the head of department) runs one department of one school. Everything they do is limited to that department.
What a Department admin manages, for their department
- Student enrolments, courses, course registrations and teacher assignments.
- The timetable and attendance.
- Admissions for the department.
- Course content for any of the department's classes.
- Exam marks, and publishing or amending the department's results.
- Training modules and certificates.
What a Department admin can only view: the school's academic structure, announcements, finance, and teacher evaluation results and analytics for the department.
What a Department admin does not do: create sessions, terms or departments, set grading schemes, run evaluation campaigns, publish announcements, handle fees, or invite new administrators.
Specialist officers
Some work is sensitive enough that it is kept off the general administrator roles and given to a dedicated officer. Each officer role applies to one school.
Finance officer
Operates the school's fees end to end: fee structures, invoices, recording payments, adjustments and discounts, scholarships, refunds and late fees, with full view of the ledger. This is the only school-level role that can change money records.
HR officer
Keeps the school's staff records: staff profiles, employment contracts, qualifications and staff documents. The HR officer also approves or rejects leave requests, either directly or by delegating that decision to a named colleague for a period.
Student welfare
Keeps the most sensitive information about students: guardian records and relationships, health profiles and history, discipline cases, restricted notes (stored encrypted) and student documents. Health and discipline history is append-only, so past entries cannot be quietly rewritten.
Payroll preparer and payroll approver
Payroll uses a two-person rule. The preparer sets up pay and calculates and submits a payroll run. The approver reviews it, approves it and posts it to the school's accounts. Nobody can approve a run they submitted themselves, even if they hold both roles. Both roles are appointed by the Account admin, for one school at a time.
Confidential by design
Staff records, payroll and student welfare records are visible to the Account admin (read only) and to their specialist officer. School admins, Department admins and teachers do not see them.
Teacher
A teacher's access follows their teaching assignments. A teacher can be placed in a school, a department, or on individual classes, and within that they work only on the classes they are assigned to teach.
For their own classes, a teacher can
- take and correct attendance,
- publish course materials, assignments and quizzes, run discussions and keep the gradebook,
- enter exam marks while the entry window is open,
- enter training module scores and print issued certificates,
- see their timetable and the school calendar.
For teacher evaluation, a teacher can see their own results, trends and comparison with peers, and reply to anonymous student comments (replies may be moderated). They cannot see who wrote a comment, and they cannot see the setup screens or other teachers' results.
A teacher does not: schedule the timetable, publish term results, configure grading, or open other teachers' classes.
Student
Students have their own portal. They see only their own studies:
- their courses, materials, assignments and discussions,
- their results and certificates,
- the teacher evaluations assigned to them, which they complete anonymously.
A student's name, email and enrolment are managed by the school, so students can change their password and profile photo but not their official details.
Parent / guardian
A parent (or guardian) only gets access when the school invites them and links them to a specific child. Through the parent portal they can see, for each linked child only:
- academic progress, results and attendance,
- school announcements,
- documents such as report cards,
- fee invoices and balances,
- private message threads with the school about that child.
A parent never sees other students, and access can be withdrawn by the school at any time.
Permission matrix
A summary of the main areas. Manage means create and change, View means read only, Own means limited to the person's own classes, children or studies, and a dash means no access.
| Area | Account admin | School admin | Dept. admin | Finance officer | HR officer | Student welfare | Teacher |
|---|---|---|---|---|---|---|---|
| Schools, billing, branding | Manage | – | – | – | – | – | – |
| Staff appointments | Manage | Own school | – | – | – | – | – |
| Activity log | View | – | – | – | – | – | – |
| Academic structure | Manage¹ | Manage | View | – | – | – | – |
| Students and enrolment | Manage¹ | Manage | Manage | – | – | – | – |
| Student personal details² | Manage¹ | Manage | Manage | – | – | – | – |
| Courses and teacher assignments | Manage¹ | Manage | Manage | – | – | – | – |
| Timetable | Manage¹ | Manage | Manage | – | – | – | View |
| Attendance | Manage¹ | Manage | Manage | – | – | – | Own |
| Admissions | Manage¹ | Manage | Manage | – | – | – | – |
| Teaching content | Manage¹ | Manage | Manage | – | – | – | Own |
| Exam marks | Manage¹ | Manage | Manage | – | – | – | Own |
| Grading setup | Manage¹ | Manage | – | – | – | – | – |
| Publish and amend results | Manage¹ | Manage | Manage | – | – | – | – |
| Certificates | Manage¹ | Manage | Manage | – | – | – | Own |
| Library | Manage¹ | Manage | – | – | – | – | – |
| Document library | Manage¹ | Manage | – | – | – | – | – |
| Announcements | Manage¹ | Manage | View | – | – | – | – |
| Teacher evaluation setup | Manage¹ | Manage | – | – | – | – | – |
| Evaluation analytics | View | View | View | – | – | – | Own |
| Parent portal access | Manage | Manage | – | – | – | – | – |
| Fees and payments | Manage¹ | View | View | Manage | – | – | – |
| Staff HR records and leave | View | – | – | – | Manage | – | – |
| Payroll | View | – | – | – | – | – | – |
| Student welfare records | View | – | – | – | – | Manage | – |
¹ For the school the Account admin has selected. Across the whole workspace the Account admin can view every area.
² A student's date and place of birth, nationality, personal email and phone, and home address. Roles that only see the student list (finance, welfare) or teach the student never see them. A student always sees their own.
Payroll is managed by the payroll preparer and approver, who share the two-person rule described above.
Who can appoint whom
| Appointed by | Can appoint |
|---|---|
| Account admin | Any role in any school: Account admins, School admins, Department admins, Finance officers, HR officers, Student welfare, Payroll preparers and approvers, Teachers and Students. |
| School admin | School admins for their own school, and Department admins for departments in their school. |
| Department admin | Nobody. They manage the people and courses in their department, not administrators. |
| School admin | Teachers, by adding them to the school. |
| School or Department admin | Students, by enrolling them; and teachers onto classes, through teacher assignments. |
| Only the Account admin | Finance officers, HR officers, Student welfare and both payroll roles. |
| School admin or Account admin | Parents, by inviting them to the parent portal for a specific child. |
Safeguards built in
- Least privilege by default: each role starts with only what its job needs. Money, staff records, payroll and student welfare are separate roles, so they are granted on purpose, never by accident.
- Personal details are their own permission: seeing a student's academic record does not reveal their date of birth, contacts or home address. Only the administrators who register students do.
- Separate duties: payroll needs two different people; a School admin sees finance but a Finance officer handles it.
- Everything is recorded: role changes and sensitive actions are written to the activity log, which the Account admin can review.
- Sign-out on promotion: when someone is given an administrative role, their existing sessions end and they sign in again with the new access.
- Protected ownership: the primary Account admin cannot be removed by anyone else, and the last Account admin cannot be removed at all.
- Two-step verification is available for every account, and we recommend it for anyone with an administrative or officer role.
What you see also depends on your plan
Roles decide what a person may do; your plan decides which modules the workspace includes. If a module is not part of your plan, nobody sees it, whatever their role.
Common setups
A single small school. One person is Account admin, School admin and Finance officer. Teachers are assigned to their classes, and parents are invited as their children enrol. Add an HR officer or Student welfare officer as the school grows.
A school with strong departments. The principal is School admin, each head of department is a Department admin, and the bursar is the Finance officer. Heads of department run their own timetable, attendance and results without touching the rest of the school.
A group of schools. The group's owner or director is the Account admin and sees everything. Each school has its own School admin and Finance officer, so no school's staff can see into another. HR, payroll and welfare officers are appointed per school.
What you achieved
- You know how a role and a scope together decide what someone can do.
- You know what each role manages, what it can only view, and what it cannot reach.
- You know who can appoint whom, and the safeguards that protect sensitive work.
Ready to put it into practice? Go to Roles, staff and access to invite your team.