Roles and permissions

The authoritative guide to institution roles, access rights, scoped assignments, profile tab visibility, and how roles interact with product packages across Fuxam Web.

Roles and permissions are the access-control foundation of Fuxam Web. A role is a named bundle of rights that determine what a person can see and do. Every user has at least one role, and their effective access is the combination of rights granted by that role, plus any scoped assignments on specific courses, cohorts, study programs, or individual users.

This chapter is the reference point for access across the handbook. OrgHub sidebar visibility, user profile tabs, invitation content, and cohort-level assignments all flow from the same model described here. For how access rights combine with product packages in OrgHub, see Permissions, features and visibility.

Why it matters

Universities run on separation of duties. Admissions staff need applicant data; module organizers need planning tools; students need their own grades — but not everyone else’s. Roles let you express those boundaries in software without creating a separate account type for every job title.

Without deliberate role design, two predictable problems appear: over-permissioning (too many people can change records they should only read) and under-visibility (colleagues cannot find menus they need for their work). Both look like product bugs but are usually configuration gaps. Investing time in roles early pays off across User Management, Study programs and cohorts, course management, and every other module that checks access before showing a page.

How it fits

Roles sit at the center of Fuxam’s access model. Feature packages determine what the institution has licensed; roles determine what each person may do with those capabilities.

Typical workflow order for a new institution:

1. Review which Fuxam product packages are enabled (Base, CMS, LMS, Apply).
2. Define institution roles that mirror real job functions — Student, Teacher, Course Coordinator, Registry staff, and similar.
3. Assign access rights per role, starting with User Management and the OrgHub areas each function needs.
4. Assign roles when creating users or adjust them later from the profile Access tab.
5. For academic structures, add scoped role assignments on cohorts or courses where organization-wide access would be too broad.

Key concepts

Organization-wide vs scoped access

Some rights apply organization-wide — for example, permission to view users lets someone see all users in the institution. Others are scoped to a specific course, cohort, study program, or person. Scoped rights only take effect when the role is assigned to that entity.

The Access tab on a user’s profile shows both general and scoped role assignments. This is especially important for cohort and program staff who need planning or enrollment rights on one intake group but not the entire institution.

Open role configuration

Roles are managed in institution Settings, not in OrgHub.

The page includes three sections:

• Superadmins — users with full administrative access.
• Roles & Permissions — the list of institution roles.
• Access packages — bundled sets of rights linked to Fuxam product packages.

Create a role

Assign access rights

Access rights are additive within a role: everything toggled on is granted to users assigned that role.

Common User Management rights

Many other categories cover OrgHub planning, curricula, exams, courses, and settings. The Permissions, features and visibility chapter maps common OrgHub sidebar items to the access they require.

Profile-related view rights

When configuring who can open which profile areas, think in plain outcomes:

Pair each view right with the matching product package (see below) so tabs actually appear.

User profile tab visibility

Each role has User Information settings that control which tabs appear on user profiles (for users with that role) and on the dashboard home screen. This is separate from OrgHub sidebar access — a teacher might see Grades on student profiles without having access to the full Exam Center.

Some tabs also require a product package (FuxamCMS, FuxamLMS, FuxamApply) or an institution setting to be enabled before they appear at all. A page or tab is visible only when both the user’s role has the required access and the institution has the relevant feature enabled.

See View a user for how profile tabs render for individual accounts.

Access packages and product packages

Access packages on the Roles & Permissions settings page link roles to Fuxam product bundles (Base, CMS, LMS, Apply). Feature packages enabled for your institution determine which OrgHub sections and user profile tabs exist.

Think of the relationship this way:

All four layers can apply simultaneously. See Permissions, features and visibility for the full OrgHub sidebar mapping.

Assign a role to a user

Assign roles when:

• Creating a user — pick an initial general role in the Add User form.
• Editing a user — change the general (primary) role in the Users table or on the Overview / Access tabs.

For academic staff who need rights on a specific cohort or study program rather than institution-wide, use scoped assignments on the Access tab or through Bulk actions Access options. You can also revoke a single scoped assignment without changing the person’s primary role.

Role-specific invite settings

Individual roles can override default invitation language, subject, text, and intro video. When set on a role, those values replace the institution defaults for users invited with that role. When not set, the defaults from Invite email settings apply.

This is useful when students and staff should receive different onboarding tone — for example, a welcome video aimed at first-year students versus a concise staff orientation message. Configure overrides on each role under Settings → Roles & Permissions, in the onboarding or invite settings section for that role.

Pending invitations remain tied to the invitee’s email and role until the person activates or the invite is cancelled or resent — see Resend an invite.

Best practices

• Mirror real job functions. Start with a small set of roles (Student, Teacher, Staff, Administrator) and split only when access rights genuinely diverge.
• Prefer scoped access for academic structures. A module organizer for one cohort rarely needs institution-wide permission to view all study programs. Assign the role on the cohort or program instead.
• Separate read from write. Give registry staff permission to view users before permission to update users until you are confident the role definition is correct.
• Document your role matrix. Maintain an internal table of which roles map to which capabilities — auditors and new administrators will ask.
• Test with a colleague. After changing a role, have someone assigned that role sign in and confirm OrgHub visibility matches expectations before rolling out widely.
• Review Superadmins periodically. Full administrative access should be limited to people who actively need it.
• Align invite overrides with audience. Student vs staff invitation tone should match the role you assign at send time.

Common pitfalls

FAQ

Related pages