School role map: who sees, changes and approves each record

Which school records should a role map start with?

Start with the information a school day actually produces, not with the menus a vendor shows. Menu labels change between products; the records and the people responsible for them do not. For each record below, settle two things before any demonstration: which office or person is the authoritative source, and who genuinely needs to see or change it.

Timetable

Which office publishes it, and do room changes reach students and guardians from that same entry?

Attendance

Which teacher marks the period, and who may correct a mark once the register has closed?

Assessment result

Who enters the mark, who approves its release, and when does a guardian first see it?

Announcement

Which record or decision authorises it, and who can withdraw or correct it after sending?

Guardian contact

Who may update a phone number or email, and how is the change checked before messages are rerouted?

What should the role-by-record matrix show?

One table, with records as rows and roles as columns. Write verbs, not “access”: viewing differs from downloading, creating from approving, correcting from deleting. A phrase such as “parents have access” hides every one of those differences. Google Classroom’s official page addresses education leaders, educators and IT administrators separately, and says parents and guardians can view assigned classwork through a link or weekly guardian email summaries; it describes Google’s product, not Easy Edu.

Which exceptions and role changes belong on the map?

School identities change all year. A demonstration built on one teacher, one class and one parent will not show how access is opened and closed when responsibilities move. Add each case below as its own row of the map and ask the vendor to show it.

How should each notification connect to its source record?

A notification is only as reliable as the record behind it. For every alert or message, the map should show the source record, what triggers it, who receives it, when and through which channel, and what happens if the record is later corrected. The most revealing test is a correction, because it shows whether a wrong message is ever put right.

How can a school test least-privilege access?

Least privilege means each role holds only the actions its task requires. Test it by asking, cell by cell, why the role needs the action. Pay particular attention to bulk downloads, administrator privileges, vendor support access and shared classroom devices, where broad access tends to hide. Each elevated permission should pass four questions:

• Need: which named task requires this action?
• Scope: which classes, children or record types does it cover?
• Duration: when does it end without someone remembering to remove it?
• Review: who checks it, and how often?

Malaysia's Personal Data Protection Department sets out seven personal-data-protection principles under section 5(1) of Act 709. They are general legal context for these questions, not a verdict on any platform. Read the department's principles

How does the map become repeatable test cases?

Turn the cells into short scenarios: include at least one permitted action, one denied action and one role change, all using non-sensitive test data and a recorded product version. Repeat the denied test after the role change. Then run the cases in a self-run school platform evaluation session so every owner sees the same result.