Build the staff roles your school actually runs on. In minutes. No IT team needed.

Why Indian schools end up sharing one password

It is admission week. Your office assistant needs to add 40 new students into the school ERP, but the software you bought five years ago only knows three kinds of users — Admin, Teacher, and Accountant. 'Admit Student' lives under Admin. So she walks into the principal's cabin at 11 a.m., asks for the password, types it into her own computer, finishes the work, and goes back to her desk. The principal's password is now on three computers in the building.

A few weeks later, a salary slip ends up in a parent's inbox by mistake — sent from a screen that someone had logged into using the principal's credentials. Nobody knows who clicked Send. The audit shows the principal sent it. He did not.

This is the everyday reality of staff access in most Indian schools running older ERPs. Either the role list is too narrow — Admin, Teacher, Accountant — and your real org chart (Vice Principal, Discipline Coordinator, House Master, Lab Assistant, Sports In-charge, Counsellor, Hostel Warden, Front Desk, Transport Coordinator, Librarian) is forced into one of three boxes. Or the system is so coarse that giving a teacher 'view student fees' also gives them 'edit fee receipts'. Either way, the office shares logins. The principal's password becomes the school's password. And when something goes wrong, nobody can prove who actually did it.

We rebuilt the role layer from scratch. With Inkwelly's Custom Role Builder, your principal sits down for thirty minutes and lays out the exact roles your school uses — by the names your school already calls them. For each role, your principal ticks exactly what that role should see and do inside Inkwelly. Save. From that day, every accountant, every class teacher, every coordinator who ever joins your school steps into a chair that already knows what they can and cannot do. No shared logins. No principal's password floating around. And when an inspector or auditor asks 'who can see what?', the answer is in front of you in ten seconds.

How the Custom Role Builder works in your school

Open the IAM dashboard in Inkwelly → click Roles → click + New Role. The builder opens with two simple sections — name and permissions.

Step 1 — name the role the way your school already names it. Type whatever your staffroom uses. Class Teacher. Vice Principal. Discipline Coordinator. Lab Assistant. Hostel Warden. Sports In-charge. Computer Teacher. House Master. Transport Coordinator. Library Assistant. Counsellor. Accounts Clerk. Front Desk. IT Helper. All valid. Add a one-line description if you want — like 'For class teachers of grades 1 to 5'. Save.

Step 2 — tick what the role can do. The permissions panel groups every Inkwelly area together — Students, Student Attendance, Employees, Fees, Payroll, Subjects, Timetable, Examinations, Transport, Library, Homework, Events, Media Center, Website CMS, AI Tools, IAM, Audit Logs. Each area opens up to show simple actions like view, create, edit, delete, import, export, approve. Tick what this role should be able to do. Skip what they shouldn't.

A Class Teacher role typically gets: see students, view and mark attendance, see the timetable, enter exam marks, create and check homework, upload media. Twelve clicks. Save. The role is live and ready to assign.

Only the modules your school subscribes to. If your school is on a basic plan and Transport is not part of it, Transport permissions do not appear in the builder. There is no way to accidentally give a role access to something your school does not own. The day you upgrade to add Transport, those permissions show up — and you decide which of your existing roles get them.

Reuse the role on every staff member. Once you have the Class Teacher role saved, every class teacher in your school gets that role assigned. Twenty-two class teachers? One role, twenty-two assignments. Tomorrow you decide class teachers should also see fee dues for their class before parent-teacher meetings — open the role, tick 'view student fees', save. All twenty-two teachers see fee dues from their next login. No per-teacher rework.

Six template roles, ready out of the box. Inkwelly ships with six pre-built role templates — Principal, Vice Principal, Teacher, Accountant, Clerk, Transport Manager — covering the most common Indian school job patterns. Click Seed Default Roles and they appear instantly with sensible permissions already ticked. Most schools use these as a starting point and customise two or three permissions per role to match their structure.

Only the modules your school owns. Nothing else.

The permission catalogue only shows the modules your school is actually using. If Transport is not part of your plan, Transport permissions do not appear in the builder. Not greyed out. Not hidden behind an upgrade pop-up. Just not there. There is no way to tick 'manage bus routes' for a role and discover six months later — when you finally add Transport — that someone got access by accident.

The day you upgrade to add Transport, every existing role keeps doing exactly what it was doing yesterday — and the new Transport section appears in the builder. You decide which roles get Transport access. A Principal role likely gets it all. A Class Teacher role likely gets none. New modules never silently expand an existing role's reach. You always tick the new permissions yourself.

Start from a template, not from a blank page

Click Seed Default Roles and Inkwelly creates six template roles instantly: Principal (full school access), Vice Principal (most areas, no payroll configuration), Teacher (attendance, homework, exams, timetable view), Accountant (full fees and payroll, view-only on staff and students), Clerk (basic data entry on students and attendance), Transport Manager (full transport area). Permission ticks are pre-filled for the typical Indian-school job pattern.

Most schools edit two or three permissions per template role to match their own structure — for example, adding 'view fee dues for my class' to the Teacher role so class teachers can spot pending fees before parent meetings. The seed action is safe to run more than once: if a role with the same name already exists, it skips it. Run it once when you set up a school. Customise from there. Add new roles for the jobs your school has that the templates do not cover.

Edit the role once, every assigned staff sees the change

A role in Inkwelly is a reusable definition, not a per-employee copy. When you tick one extra permission on the Class Teacher role, every class teacher in your school sees that new permission on their next login. No re-assignment. No support call. No browser-cache clearing. The role is the source of truth, and assignments are simply pointers to it.

This is how Inkwelly handles structural change in your school without the two-day rollout cycle older ERPs need. New CBSE circular asks class teachers to also approve transport waivers? Open the role, tick the permission, save. Twenty-two teachers, one change, one minute. Decide the next week it was a mistake? Untick the permission, save. Their access shrinks back in the same minute. The control sits with your principal — not with a vendor's helpdesk.

Safety rails so a misclick never breaks production

Inkwelly has two delete rules so an honest mistake on a busy morning does not lock your school out.

Built-in template roles cannot be deleted. The six template roles — Principal, Vice Principal, Teacher, Accountant, Clerk, Transport Manager — are protected. The Delete button is greyed out with a tooltip explaining why. You can edit their permissions freely, deactivate them, even rename them. But you cannot remove them. So a school recovering from a misconfiguration always has these baselines to fall back to.

A role with active staff cannot be deleted. If even one teacher is currently assigned the role, the system blocks the delete with a clear message: 'This role has 22 active staff members and cannot be deleted'. Either revoke the assignments first using Role Assignments, or simply mark the role inactive — inactive roles stay in the system, retain their assignment history for audit, but no new logins use them. No teacher ever loses access by accident.

Each school in your trust has its own role list

Your Lucknow school's Accountant role and your Bareilly school's Accountant role are completely independent. Same name, separate permissions, separate audit history, separate staff. This is on purpose — different schools in the same trust often have different staff designations, different module subscriptions, and different governance rules.

A central trust admin can stand up the same role across all 12 schools using a one-time setup, but the rows stay independent. Editing the Lucknow Accountant role does not change the Bareilly one. Removing a teacher from the Patna school does not affect their access at any other school in the trust. Each school's data is isolated end-to-end — there is no path for a school-level user to read another school's role list, even if they tried.

Real-world roles Indian schools build in Inkwelly

Five realistic roles that production Inkwelly schools have running today, with what each role typically contains:

1. Class Teacher. See students. View and mark attendance for the class. See subjects and timetable. Enter exam marks. Create, edit, and check homework. View school events. Upload media. Self-service their own attendance. About 20 ticks. The daily-driver role used by most CBSE and ICSE schools.

2. Senior Accountant. Full access to fees — set structures, raise invoices, collect cash and online, issue receipts, manage refunds, run reversals, manage scholarships, manage cheques, see the dashboard. Full access to payroll — salary heads, monthly run, TDS, EPFO, ESIC, full-and-final. View-only on students and staff. View-only on transport with the ability to handle transport fees and refunds. The accountant who closes books, runs payroll, and files monthly compliance.

3. Junior Accountant. View fees. Collect cash and online payments. Issue receipts. Manage cheques. View students and staff so they can search. View transport. No refunds, no reversals, no payroll, no fee config. The collection counter operator at your front desk who can take money and issue receipts but cannot edit a fee structure or reverse a payment.

4. Transport Coordinator. Full transport access — fleet, drivers, routes, stops, student and staff route mapping, trips and attendance, transport fees, refunds, parent requests, configuration, safety. View students and staff so they can search. Zero access to fees, payroll, or examinations. The person who runs your morning bus operation.

5. Vice Principal. Read-only across most areas with edit access on academics, attendance, homework, events, and timetable. Cannot run payroll. Cannot edit fee configuration. Cannot delete a student profile. Exactly the principle of 'oversight without unilateral execution authority' that most schools' governance documents already specify on paper but no ERP has ever enforced.

Each role takes two to four minutes to build the first time. After that, every new staff member who steps into the chair is productive in 30 seconds — assign the role, give them their login, work begins.

See the role builder live on your school's modules

30-minute walkthrough — bring your school's actual staff designation list. We will build five of your most critical roles together, on your real Inkwelly setup.

Limits, safety, and the small print

Build as many roles as you need. No per-school limit. Even schools with 200+ staff and 15 distinct designations rarely create more than 12 to 15 roles in production — the same role is reused across every staff member who does that job. If you find yourself making role number 25, that usually means the lines are too fine — group similar roles, or use multi-role assignment instead.

Your role definitions never silently expand. When Inkwelly ships a new feature, the new permissions are added to existing modules without renaming or removing anything you have already built. A role you saved in 2024 still works in 2026. New permissions default to off until you tick them. Your access policy never grows behind your back.

Template roles are templates, not frozen. The six built-in roles are fully editable. Remove permissions, add permissions, rename them — they are starting points, not contracts. The only restriction is that they cannot be deleted, so you always have a recovery baseline.

Role names must be unique within your school. Two roles named Accountant in the same school is rejected with a friendly error. Across different schools in the same trust, names are independent — Lucknow's Accountant and Bareilly's Accountant are separate.

Save-time validation. When you save a role, Inkwelly checks that every ticked permission belongs to a module your school has subscribed to. If something is wrong, the save fails with a clear message — never with the wrong permissions silently saved. Your role definition either works or returns a precise reason.

Live count of staff per role. The roles list shows, for every role, how many active staff currently hold it — Principal: 1, Class Teacher: 22, Accountant: 3. So before you change a high-impact role, you see the blast radius. The number updates in real time as your principal assigns or revokes.

Multi-school isolation. Like every Inkwelly area, your roles are strictly within your school. No role from another school is visible or assignable. Multi-school trusts run independently, with the trust-admin level providing cross-school visibility for reporting only — never for editing.

Built on the Inkwelly audit log. Every role created, edited, or deleted, and every permission ticked or unticked, is recorded in Audit Logs with timestamp and the admin who made the change. If a permission was added in May and removed in October, both events are in the log. This is the trail your DPDP-compliance evidence is built on.