User Roles & Permissions

ShulNET uses a role-based access control system to ensure users only have access to features appropriate for their responsibilities. Understanding these roles helps maintain security and proper data management.

Available User Roles

Users can have multiple roles simultaneously. For example, a user can be both a Teacher and a Parent, or a Member and a Teacher.

🔑

Admin

Full system access with all administrative privileges

Highest Access
👤

Member

Access to personal member portal and information

Member Access
🍎

Teacher

Teaching privileges for Hebrew school classes

Teaching Access
👨‍👩‍👧

Parent

Parent/guardian access to student information

Parent Access
🎓

Student

Student access to their own records

Student Access

Role Permissions

Admin Role

Administrators have complete access to all system features:

Full Access To:

Important: Admin access should be limited to trusted individuals. Admins can modify any data and access sensitive financial information.

Teacher Role

Teachers have access to manage their classes and students:

Can Access:

Cannot Access:

Common Teacher + Role Combinations:

  • Teacher + Parent: Teaching while having enrolled children
  • Teacher + Member: Member who teaches classes
  • Teacher + Admin: School director with teaching duties

Parent Role

Parents have access to their children's information:

Can Access:

Cannot Access:

Note: Parent role is automatically linked to specific student records, so parents only see their own children.

Member Role

Members have access to their personal information through the member portal:

Can Access:

Cannot Access:

Privacy: Members can only view their own information and public event/calendar data.

Student Role

Students have access to their own academic information:

Can Access:

Cannot Access:

Typical Usage:

  • Teen students checking their grades
  • High school students accessing class materials
  • Students viewing their own progress

Multiple Roles

ShulNET supports users having multiple roles simultaneously. This is particularly useful for:

Common Multi-Role Scenarios

  • Member + Parent: A member with enrolled children
  • Member + Teacher: A member who teaches Hebrew school
  • Teacher + Parent: A teacher with their own children enrolled
  • Admin + Member: Administrator who is also a member
  • Admin + Teacher + Parent: School director who teaches and has children enrolled
Flexible Access: When a user has multiple roles, they get the combined permissions of all their roles. The interface adapts to show relevant features for each role.

Permission Comparison Table

Feature Admin Member Teacher Parent Student
User Management ✅ Full ❌ No ❌ No ❌ No ❌ No
Member Management ✅ Full 🔒 Own Only ❌ No ❌ No ❌ No
Student Management ✅ Full ❌ No 📚 Own Classes 👨‍👩‍👧 Own Children ❌ No
Class Management ✅ Full ❌ No ✅ Own Classes 👁️ View 👁️ View Own
Attendance ✅ Full ❌ No ✅ Take/Update 👁️ View Own 👁️ View Own
Grades ✅ Full ❌ No ✅ Record/Update 👁️ View Own 👁️ View Own
Invoices ✅ Full 🔒 View Own ❌ No 💳 View/Pay ❌ No
Payments ✅ Full 💳 Pay Own ❌ No 💳 Pay Own ❌ No
Events ✅ Full 👁️ View/RSVP 👁️ View/RSVP 👁️ View/RSVP 👁️ View
Yahrzeits ✅ Full 👁️ View Own ❌ No ❌ No ❌ No
Email Campaigns ✅ Full 📧 Receive 📧 Receive 📧 Receive 📧 Receive
Reports ✅ All ❌ No 📊 Class Only ❌ No ❌ No
System Settings ✅ Full ❌ No ❌ No ❌ No ❌ No

Managing User Roles

Assigning Roles (Admin Only)

  1. Navigate to Users

    From the admin menu, click "Users" to see all user accounts.

  2. Select User

    Find the user whose role you want to change.

  3. Edit Roles

    Click "Edit Roles" button.

  4. Select Role(s)

    Check the boxes for roles you want to assign. You can select multiple roles.

    • Admin
    • Member
    • Teacher
    • Parent
    • Student

  5. Save Changes

    Click "Save" to update the user's roles.

  • Edit Role

    Click "Edit" and select the new role from the dropdown.

  • Save Changes

    Click "Save" to apply the new role. Changes take effect immediately on next login.

    • Creating User Accounts

    User accounts can be created in two ways:

    From Member Records

    1. Open a member's profile
    2. Click "Create User Account"
    3. System generates temporary password
    4. User automatically assigned "Member" role
    5. Additional roles can be added after creation
    6. Email credentials to the member

    Direct User Creation (Admin)

    1. Navigate to Users → Add User
    2. Enter name and email
    3. Select initial role(s)
    4. Generate password
    5. Save and send credentials

    Best Practices

    Security Guidelines

    • Limit the number of Admin role assignments to essential staff only
    • Regularly review user roles and remove unnecessary access
    • Deactivate accounts for staff who leave
    • Require strong passwords for all users
    • Enable two-factor authentication for Admin users
    • Review parent/student role assignments when families leave

    Role Assignment

    • Assign the minimum necessary roles for each user's responsibilities
    • Document why users have elevated permissions (especially Admin)
    • Review roles quarterly or when responsibilities change
    • Use Member role for all congregation members
    • Automatically assign Parent role when linking to student records
    • Consider Teacher + Parent for teachers with enrolled children

    Training

    • Train teachers on their classroom management features
    • Provide member portal guides to new members
    • Show parents how to view their children's information
    • Document role-specific procedures
    • Have admins mentor new staff members

    Common Questions

    Can a user have multiple roles?

    Yes! Users can have multiple roles simultaneously. For example, a teacher who is also a parent can have both Teacher and Parent roles. The system combines permissions from all assigned roles.

    Can I customize role permissions?

    The five standard roles (Admin, Member, Teacher, Parent, Student) have defined permissions in the system. Contact your system administrator or developer for custom permission requirements.

    What happens when I change someone's roles?

    Permission changes take effect immediately. The user will see different menu options and access levels on their next page load or login.

    How do I remove someone's access?

    Admins can delete user accounts or remove all roles. Deleting is permanent; removing roles while keeping the account maintains it for potential future use.

    Can members see other members' information?

    No. Members can only view their own profile, invoices, and yahrzeits. Parents can view their own children's student information. Teachers can view students in their assigned classes. Only Admin role can view all information.

    How does the Parent role get assigned?

    The Parent role should be assigned when creating or editing a user account for someone who has enrolled children. Parents are linked to specific student records to control which children they can view.

    Do students need user accounts?

    It's optional. Younger students typically don't need accounts; parents access their information. Older students (teens) can have accounts with the Student role to view their own grades and assignments.

    Who can create invoices?

    Both Admin and Office roles can create and manage invoices. Members can only view their own invoices.

    Related Documentation