Overview
Permissions in Shams AI are role-based. Each user has a primary role, and admins can layer additional restrictions on top.
Primary roles
| Role | Sees | Cannot see |
|---|---|---|
| Student | Their own records, analysis, settings. | Other students' data. |
| Parent | Linked children's records and analysis. | Anything not linked to their children. |
| Teacher | Their assigned students' records and analysis. | Students outside their classes; admin-only configuration. |
| Organization Admin (full) | Everything in the organization. | Other organizations. |
| Organization Admin (program-scoped) | Only the programs they're scoped to. | Other programs in the same organization. |
| System Admin | All organizations. | — |
Permission layers on top of roles
Admins can further restrict what specific roles can do, including:
- Editing window — limit how long a teacher can edit a record after creating it (e.g., same day only).
- Deleting records — disable for teachers, allow only admins.
- Custom lessons visibility — restrict who can create custom lesson types.
- Exports — restrict who can export student data.
- Parent linking — require admin approval for new parent links.
Default permissions
Out of the box:
- Teachers can edit their own records for 24 hours.
- Teachers cannot delete records.
- Teachers can create custom lessons (visible to themselves only).
- Parents can view but not edit anything.
- Admins can do everything within their scope.
Changing permissions
From Admin → Permissions, you'll see a checklist. Toggle and save. Changes apply immediately.
Tighten with care. Removing permissions teachers actively use will surprise them. Communicate first.
Best practices
- Start permissive, tighten as you grow. Default settings work for most small organizations.
- Tighten editing windows once you scale. "24h edit window" prevents historical revision.
- Use program-scoped admins for departmental separation. Avoids accidental cross-department changes.