Roles and Access
Access is role-based. Each role should only see workflows required for its responsibility.
Use the login page to enter the platform through the approved identity provider. Protected admin, finance, mentorship, and membership pages are only available after signing in with the right role.
How to Handle Disabled Buttons
- Hover over the button if a tooltip is available.
- Check whether the record is already in the target status.
- Check whether your role has permission.
- Check whether a required field, invoice, payment, or approval is missing.
- If it still looks wrong, capture the page and record name for support.
Common Roles
| Role | Expected Access |
|---|---|
| Superadmin | Global settings, finance settings, user access, email provider controls, and operational configuration |
| Admin | Student management, manual enrollments, sessions, events, attendance, and support actions |
| Finance | Invoices, payments, allocations, Bukku sync, company finance profile, SST, and payment gateway settings |
| Mentorship Admin | Mentorship students, checkpoint validation, sessions, performance, and mentorship targets |
| Membership Admin | Membership records, membership types, renewals, and member validity |
| Student | Assigned programs, invoices, payments, sessions, documents, attendance, and checkpoint actions |
Access Rules
- Students should never see internal admin pricing controls, payment gateway fee settings, or administrative finance tools.
- Finance-only settings should not be editable by non-finance roles.
- Superadmin-only controls should include email sending enablement and email provider selection.
- Suspension actions should be accessible only to approved admin profiles.
- Audit logs should show readable names and labels instead of UUID values wherever possible.
When Access Looks Wrong
Check these items first:
- The signed-in user's role
- Whether the page is protected by the correct role group
- Whether API responses are filtered by role
- Whether frontend tabs or buttons are hidden, disabled, or incorrectly reused from admin views