Authorization

Permission matrix

This table is generated directly from the code that enforces access. Every entry is checked on the server for page loads, API calls, and individual record access - hiding a navigation link is never the control.

Back

Two checks, always

A request passes only if the role holds the permission and the specific record is in the caller’s scope (same organization, and either their own record or one an elevated permission covers). Denied requests are written to the audit log.

Learning content

Published content is immutable. Editing creates a draft; only an Admin can publish a new version.

Permission	ADMIN	SCHEDULER	EMPLOYEE
content.view.published	✓	✓	✓
content.view.drafts	✓	✓	—
content.create	✓	—	—
content.edit.any	✓	—	—
content.edit.delegated	—	✓	—
content.submit_for_approval	✓	✓	—
content.publish	✓	—	—
content.archive	✓	—	—
content.assign	✓	—	—

Scheduling

The Scheduler's core remit: dates, ordering, and the minimum roster needed to do it.

Permission	ADMIN	SCHEDULER	EMPLOYEE
calendar.view	✓	✓	—
calendar.schedule	✓	✓	—
calendar.adjust_due_dates	✓	✓	—

Roster

Name, location, and team only.

Permission	ADMIN	SCHEDULER	EMPLOYEE
roster.view_minimal	✓	✓	—

Learner experience

Permission	ADMIN	SCHEDULER	EMPLOYEE
learning.view_assigned	✓	—	✓
learning.complete	✓	—	✓

Practice

Permission	ADMIN	SCHEDULER	EMPLOYEE
practice.run	✓	—	✓

Progress

Permission	ADMIN	SCHEDULER	EMPLOYEE
progress.view_own	✓	—	✓

Assessment

Employees see their own feedback and may request a human review. Corrections require a recorded reason.

Permission	ADMIN	SCHEDULER	EMPLOYEE
assessment.view_own	✓	—	✓
assessment.request_review	—	—	✓
assessment.review	✓	—	—
assessment.correct	✓	—	—

Performance data

Deliberately unavailable to the Scheduler role, including through direct API calls.

Permission	ADMIN	SCHEDULER	EMPLOYEE
metrics.view_org	✓	—	—
metrics.view_individual	✓	—	—

Transcripts

Private recordings and transcripts.

Permission	ADMIN	SCHEDULER	EMPLOYEE
transcripts.view_any	✓	—	—

Workplace outcomes

Permission	ADMIN	SCHEDULER	EMPLOYEE
outcomes.manage	✓	—	—

Knowledge base

Permission	ADMIN	SCHEDULER	EMPLOYEE
knowledge.search	✓	—	✓
knowledge.manage	✓	—	—
knowledge.approve	✓	—	—

Communication

The Scheduler role has no communication permission of any kind. Automatic assignment notices are transactional system notices, not messages, and cannot be customised.

Permission	ADMIN	SCHEDULER	EMPLOYEE
comms.announce	✓	—	—
comms.send_message	✓	—	—
comms.reply	✓	—	✓
comms.post_question	✓	—	✓
comms.moderate	✓	—	—

Administration

Permission	ADMIN	SCHEDULER	EMPLOYEE
users.manage	✓	—	—

Permission	ADMIN	SCHEDULER	EMPLOYEE
roles.manage	✓	—	—

Permission	ADMIN	SCHEDULER	EMPLOYEE
org.manage	✓	—	—

Permission	ADMIN	SCHEDULER	EMPLOYEE
settings.manage	✓	—	—

Permission	ADMIN	SCHEDULER	EMPLOYEE
audit.view	✓	—	—

Additional rules not expressible as a grid

No user may change their own role, including an Admin. A second administrator must make the change, and it is written to the audit log.
A Scheduler’s content.edit.delegated grant is per-module and per-field. Fields outside the delegation are rejected even when included in a crafted request body.
Answer keys, question explanations, scoring rubrics, skill tags, approved brand guidance, permissions, and platform settings are never delegatable.
A Scheduler may schedule only for employees at their own location, and sees only name, location, and team.
Employees can reach only their own attempts, practice sessions, transcripts, and assessments. Another employee’s record id returns 403, not an empty result.
The demo role selector exists only when the app is running in demo mode. In connected mode the endpoint refuses outright.