Who can do what, per organization
Roles & permissions
| Permission | Employee | Manager | Trainer | L&D Admin | Reviewer | Course author (custom) |
|---|---|---|---|---|---|---|
| course.view View enrolled courses | ||||||
| course.create Create course | ||||||
| course.publish Publish course | ||||||
| activity.submit Submit activities | ||||||
| grade.override Override grade | ||||||
| report.view View reports & analytics | ||||||
| user.manage Manage users | ||||||
| org.manage Manage organizations | ||||||
| migration.run Run Moodle migration | ||||||
| audit.view View audit log | ||||||
| course.assign Assign courses to others | ||||||
| course.edit Edit course content | ||||||
| course.enrol Enrol in courses | ||||||
| course.review Review courses | ||||||
| forum.post Post in forum | ||||||
| grade.edit Edit grades | ||||||
| knowledge.author Author knowledge articles | ||||||
| knowledge.review Review knowledge articles | ||||||
| knowledge.view View knowledge articles | ||||||
| request.approve Approve training requests | ||||||
| session.manage Manage training sessions | ||||||
| session.register Register for sessions | ||||||
| team.view View team dashboard |
Fine-grained policy table. Core roles ship with defaults; each cell above is one row in the policy table (role, permission, allow). Changes apply on the user's next token refresh and are written to the audit log. The L&D admin role holds every permission and cannot be edited.