Role and permission guide for exams, gradebooks, and report cards

1. List the decisions and roles

Identify teachers, department leads, exam officers, administrators, records, leaders, learners, families, IT, support, suppliers, and integration users. For each, name the assessment or report decision they must make.

Separate ordinary work from sensitive work such as moderation, approval, publication, correction, export, archive, special consideration, withdrawal, safeguarding, or incident response.

2. Define permission actions

Map view, create, mark, edit, review, moderate, approve, publish, export, correct, archive, and delete. State whether access is by role, subject, cohort, campus, learner, assessment, grading period, or temporary assignment.

Avoid broad “administrator” access when a narrower task role will work. Record who approves access, who reviews it, how staff leavers and substitutes are handled, and how supplier or support access expires.

3. Test real cases

Rehearse assessment setup, marking, missing submission, late work, absent learner, moderation adjustment, amended mark, resit, special consideration, withdrawal, transfer, report correction, duplicate, and outage.

Check what each role can see, change, approve, export, communicate, and restore. Record expected and observed result, evidence, limitation, owner, and correction route.

4. Protect the record

Keep original mark, moderated mark, final grade, reason, reviewer, approver, date, version, report effect, correction history, and audit trail appropriately separated and visible to authorised reviewers.

The U.S. Department of Education data governance checklist covers quality, access, security, lifecycle, sharing, disposal, and monitoring. Use it to review shared devices, downloads, links, notifications, and integrations.

5. Include user experience

Permissions should make the correct action clear. Provide accessible labels, meaningful errors, role training, support, recovery, language, device, connectivity, privacy, safeguarding, and security guidance.

GOV.UK guidance emphasises accountable handling of school data. Do not use a role model to claim legal compliance; apply qualified local privacy, safeguarding, records, security, accessibility, and legal review.

6. Govern change

Require review for a new subject, cohort, campus, grading scale, assessment, report, integration, family view, supplier, role, or export. Record reason, risk, test, approver, effective date, communication, rollback, and review.

The U.S. Department of Education data-quality guidance links reliable information with definitions, rules, validation, infrastructure, and professional learning. Keep permissions aligned with approved definitions and workflows.

7. Review access regularly

At 30, 60, and 90 days, review access exceptions, exports, corrections, moderation, staff effort, support demand, report confidence, incidents, inactive accounts, temporary roles, and the original outcome.

Remove unnecessary access, repair confusing roles, document unresolved risk, and retest after material change. A least-privilege design requires ongoing review, not only initial configuration.

Turn the guidance into an accountable decision

Apply this guidance to one bounded part of role and permission guide for school exam and gradebook software. Define the assessment or reporting decision, authoritative record, accountable owner, permitted users, correction route, evidence, and review date.

Test an ordinary assessment and meaningful exceptions such as a missing submission, late work, absent learner, moderation change, amended result, withdrawn learner, duplicate mark, grading-period change, report correction, access failure, or outage.

Keep supplier capability, school responsibility, professional judgement, local policy, legal advice, and measured outcome separate. If evidence is incomplete, narrow the claim and pilot the smallest safe change.

Review at 30, 60, and 90 days. Check completeness, timeliness, consistency, moderation, corrections, access exceptions, staff effort, support demand, reporting confidence, and the original outcome. Decide whether to expand, repair, consolidate, narrow, or hold.

Before approval, ask a reviewer who was not involved in the design to challenge the strongest assumption. Replace broad language with the exact evidence, population, date, and limitation the school can verify.

Document what was tested and what was not. A successful demonstration with a simple gradebook does not establish readiness for moderation, resits, special consideration, changed grading periods, multiple campuses, or a changed assessment policy.

Keep evidence beside the decision record so a later reviewer can distinguish observed behaviour from an assumption, estimate, or supplier statement. Name the next test where evidence remains incomplete.

Revisit the boundary when the school adds a subject, year group, campus, grading scale, role, integration, reporting period, or policy. A small change can alter permissions, definitions, calculation, timing, retention, or support demand.

Set the next review date and owner. A dependable exams and gradebook operation is maintained through clear definitions, controlled change, professional judgement, and visible accountability rather than a one-time setup.

Make the handoff readable to a teacher, administrator, leader, learner, and reviewer. State what passed, what remains manual, which records are authoritative, who owns unresolved conflicts, and how a correction is communicated without creating an uncontrolled copy.

Keep approved definitions beside calculation rules, moderation notes, training, support routes, and change history. New subjects, scales, integrations, or reporting windows can change the risk even when field names stay the same.