Restricting Access to Specific Functions

Overview

Grado’s Role-Based Access Control (RBAC) system allows administrators to fine-tune access by enabling or disabling specific actions within modules.

This ensures that each user only performs tasks appropriate to their role — for example, an Assistant Registrar may create student records but only a Registrar can edit them.

Restricting access reduces errors, protects sensitive data, and supports clear segregation of duties.

1. Where to Control Access

Access control settings are managed in Setup > Roles (or in Setup > Permissions for direct permissions).

Each role lists all Grado modules, with checkboxes representing available actions (e.g., View, Edit, Approve).

Admins can check or uncheck permissions as needed to restrict access to specific functions.

💡 Tip: Always review permissions from the role level, not individual user profiles, to ensure consistent access across the same function or department.

2. Understanding Action Types

Each module in Grado includes one or more action-based permissions.

💡 Note: Not all modules support every action type — high-level permissions like Configure or Approve appear only in administrative areas.

3. Examples of Restricted Function Scenarios

4. Combining Restrictions and Permissions

When users have multiple roles:

• Permissions are merged across all assigned roles.

• If one role allows Edit and another allows only View, the user retains Edit access.

💡 Tip: For users with overlapping roles (e.g., Cashier + Registrar), review combined permissions regularly to ensure they don’t grant unintended privileges.

To enforce stricter limits, create a dedicated restricted role instead of combining broad ones.

5. Roles vs Direct Permissions

Grado supports two ways to manage permissions under its role-based access system:

1. Role-Based Management (Recommended)

   • Create roles (e.g., Registrar, Cashier, IT Staff).

   • Attach permissions to those roles.

   • Assign the roles to users.

   • Ideal for larger schools where multiple users share the same responsibilities.

2. Direct Permission Management

   • Open a user’s profile and go to View/Edit Permissions.

   • Select or deselect specific permissions directly.

   • Useful for one-off access configurations or testing new modules.

💡 Note: Applying a role template and editing permissions manually both work. When both are used, manual permission edits take precedence and are saved per user, even if their role template changes later.

6. Restricting Access to Modules Entirely

To prevent a Role from seeing a module:

1. Go to Setup > Roles -> Edit Role.

2. Locate the module in the list.

3. Uncheck View permission.

The module and all related menu items will become inaccessible to the user and the 401 message appears when user accesses that module:

This is useful when a user’s role doesn’t require that area (e.g., hiding Finance from Academic staff).

💡 Note: Some modules are interdependent. Removing access to Students may also affect access to Classes or Reports.

7. Testing Restricted Access

After updating role permissions:

1. Ask a test user to verify visibility.

2. Adjust permissions as needed and click Save Changes.

Regular access testing helps prevent accidental exposure of confidential data.

8. Best Practices

• Start with minimum permissions and grant additional ones only as needed.

• Create separate roles for data entry and approval to maintain checks and balances.

• Document all permission changes for audit tracking.

• Review access settings whenever new modules or updates are deployed.

💡 Security Tip: For temporary access needs (e.g., replacement staff), assign a role with limited duration and remove it after the period ends.

Summary

Access restrictions in Grado are managed through role-based permissions that define exactly what users can view, edit, or approve.

By carefully adjusting module actions under Setup > Permissions, administrators ensure secure, role-appropriate access for all users.