Role-Based Access Control: Who sees what. You decide.
Give every staff member a role — Principal, Accountant, Teacher or one you make — and tick exactly what it can see and do, module by module. Class teachers open only what you allow about their children, and every fee collection asks for a PIN.
17 roles15 ready-made · 2 your ownFee Counter saved5 of 420 permissions84 of 86 staff covered2 new joiners to assign
What is role-based access control in a school ERP?
The right keys. For every job.
Role-based access control means staff get into the school software through a role — Principal, Accountant, Class Teacher — not a shared password. Each role is a list of permissions, module by module: who can view, collect, reverse, export or approve. Give a person one role or several, and Inkwelly shows them only that work — and checks it on every screen.
Also called user roles and permissions, staff access control or identity & access management (IAM).
- Modules8 — fees, payroll, Money Book…
- CanCollect fees, run payroll, close the day
- Can'tMark attendance or enter marks
- Transaction PINOn every collection and reversal
- MembersMohd. Imran, Ritu Malhotra
- Last changeRitu added · Rakesh Kumar, 12 Oct
What Inkwelly Roles & Permissions includes
- 15 ready-made roles for Indian school staff, created in one click
- Custom roles with permissions picked module by module
- Over 400 permissions — view, create, collect, approve, reverse, export
- More than one role per staff member; their access adds up
- Assign and revoke roles in a click; changes apply at once
- Switch a role off without deleting it
- Class teachers mark attendance only for their own class
- Choose what each class teacher sees about a child, section by section
- Hide fee amounts from teachers while dues stay visible
- 4-digit Transaction PIN on fee collection, reversal and fee changes
- Security log of every PIN attempt, with device and place
- Inkwelly AI that answers who-can-do-what and follows each person's role
Updated
Why schools move from a shared admin login to roles and permissions
One password for all. Or a role for each.
In most schools one admin login gets passed around — and everyone who has it sees everything. In Inkwelly each person signs in as themselves and sees only their work.
How most schools do it today
One admin password. On a sticky note, and on WhatsApp.
- One admin password, on a sticky note and in WhatsApp chats
- Whoever has it sees fees, salaries and marks — everything
- A new joiner waits days for the vendor to make a login
- Staff who left still know the password
- Nobody can say who changed what, or when
With Inkwelly
- PPrincipal1 member · 252 permissionsSystem
- TTeacher52 members · 47 permissionsSystem
- AAccountant2 members · 59 permissionsSystem
- CClerk4 members · 29 permissionsSystem
- FFee Counter2 members · 5 permissionsCustom
- EExam Cell3 members · 9 permissionsCustom
Their own sign-in. A role for each job. Every change logged.
- Everyone signs in as themselves, with a role for their job
- Each role opens only its own modules and actions
- A new joiner gets the right role in a minute
- Take a role away and the access ends at once
- Every role given or changed is logged — who and when
Create custom roles and set permissions module by module
Tick what the job needs. Nothing more.
Start from 15 ready-made roles or make your own. Open a role, pick a module and tick its permissions — collecting a fee, reversing one and seeing fee totals are three different ticks.
- 1Tick what the job needs
- 2Save — it applies at once
- 3Assign it to the right people
Sample school. Reverse Payment stays with the Accountant. One person can hold more than one role.
Class teacher access: choose what each teacher sees about a child
Her class. Only what you allow.
Attendance is always open to the class teacher. Everything else in a child's record — parents, fees, health, documents — is your call, section by section. Fee status can show without a single rupee.
- 1Turn sections on or off
- 2Save access
- 3Her app shows exactly that
Sample class. Opening personal details, bank details, documents, fees or health is recorded against the teacher's name. A teacher can also be allowed to request corrections, which the office approves.
Transaction PIN for fee collection, with a security log
A PIN on every rupee. A record of every try.
Like a UPI PIN: before anyone collects or reverses a fee, Inkwelly asks for their own 4-digit PIN. Every attempt is logged with the device and the place — so a borrowed phone can't move money quietly.
Inkwellynow- 1Collect at the counter
- 2Confirm with the PIN
- 3Logged with device and place
Sample school. Your school decides: a PIN every time or once every few minutes on one device; location off, recorded or required; and alerts to the person and to admins.
A new accountant's first week, from joining to first collection
New joiner. Right access, day one.
Ritu joined as an accountant on Monday. Here is her access, step by step — each change logged, each rupee confirmed with her own PIN.
- Mon 12 Oct, 9:30 amNo role yet
Joins the staff
Her record is added in Staff Records. Until she has a role, the fee module stays closed to her.
- Mon, 11:15 amAccountant
Gets a role
The principal gives her Accountant on the Assignments page. Fees, payroll and Money Book open for her at once.
How it works — Gets a role - Mon, 11:30 amTransaction PIN set
Sets her PIN
She picks a 4-digit PIN, confirmed with a code sent to her phone. Easy ones like 1234 are refused.
- Tue 13 Oct, 9:10 am₹12,000 · PIN verified
First collection
At the counter she enters her PIN. The collection is logged with her phone and the place.
- Today · Fri 16 Oct
- Whenever she leavesRole revoked
Moves on, some day
Revoke her role and the access ends that moment. Forget, and Inkwelly AI lists former staff who still hold a role.
Access control built for how Indian schools run their office
Made for Indian schools. And their fee counters.
The staff, desks and money habits of Indian schools — already understood.
A UPI-style PIN at the counter
A 4-digit Transaction PIN before anyone collects or reverses a payment, or changes a student's fee — school fees and transport fees.
Roles your staff already have
Principal, Vice Principal, Accountant, Clerk, Front Desk, Transport Manager, Hostel Warden, PE Teacher, School Nurse — 15 ready to use.
RTE and scholarships, kept apart
Managing RTE reimbursements and scholarships are permissions of their own — give that desk only that.
Aadhaar, PEN and APAAR on need-to-know
A child's personal details stay off for class teachers until you turn them on — and every open is recorded.
Dues without the rupees
Class teachers can follow up a pending fee without seeing what the family pays: the amounts show as ₹••.
One trust, many schools
Each school of your trust or society keeps its own roles. Group admins see every school without needing one.
Access for the principal, the accounts office, class teachers and the trust
One school. Four kinds of access.
Roles are for staff. Parents and students only ever see their own child's record.
Principal
Builds the roles, gives them out and sees every PIN attempt, lockout and collection away from campus.
Accounts office
Fees, payroll and Money Book — nothing else — with every collection confirmed by their own PIN.
Class teacher
Marks today's attendance for their own class and opens only the parts of a child's record you allow.
Trust & owners
Full access across every school in the group. Roles don't apply to owners and organisation admins.
Ask Inkwelly AI who can do what, in English or Hindi
Ask who can do what. Get names, not guesses.
Ask in English, Hindi or Hinglish. Inkwelly AI reads your roles and assignments — who can collect fees, what one person can open, who has no role yet — and answers with names, or makes the Excel. It reads access; it never changes it.
It answers. It also does the paperwork.
- Spot
Access that needs a look.
It finds former staff who still hold a role, new joiners with none, and permissions sitting on a module that's switched off.
- Reports
Excel or PDF, in seconds.
Ask for any list of roles, people or permissions and download it as a file.
- Cards
One person's access, in the chat.
Their roles, what they can do, and a button to the Assignments page.
- Letters
An office order, on your letterhead.
It drafts the order with the right names and roles. You check it, then it issues the PDF with a serial number.
- How-to
“How do I give a new accountant fee access?”
Clear steps for any task, with a button to the right page.
- Safe by design
Your data. Your rules.
You approve every changeFollows each person's roleEvery question and action loggedNever used to train AI - AI Connect
Also in Claude and ChatGPT.
Ask about roles and access inside Claude or ChatGPT — through a key you scope.
See everything Inkwelly AI can do
Inkwelly AI and AI Connect come with the Premium plan. Inkwelly AI reads roles and access; it never changes them. Answers above are from a sample school.
Roles and permissions connected to every module
Set once. Respected everywhere.
Every module checks the same roles — the fee counter, the attendance register, report cards, payroll and Inkwelly AI.
Roles & permissions
One set of roles, checked on every screen — on the web, in the app and by the AI.
Staff Records
Roles go to the people in your staff records.Student Fees
Collect, reverse and see amounts — separate keys, with a PIN.Attendance
Today, past days and any class are separate permissions.Academics
Class teachers — and what they may see about a child.Exams
Entering marks and verifying them are kept apart.Transport
Transport fees ask for the same Transaction PIN.Payroll
Salaries stay with the accounts roles.AI Connect
Who may issue AI keys is a permission too.Roles and permissions features
Every feature, explained.
Each part of Roles & Permissions has its own page, with screens and steps.
Roles and permissions: questions schools ask.
Role-based access control means staff get into the school software through a role — Principal, Accountant, Class Teacher — not a shared password. Each role is a list of permissions, module by module: who can view, collect, reverse, export or approve. Give a person one role or several, and Inkwelly shows them only that work — and checks it on every screen.
Fifteen: Principal, Vice Principal, Teacher, Accountant, Clerk, Transport Manager, Store Manager, Storekeeper, Store Cashier, Hostel Warden, School Nurse / Medical Officer, PE Teacher, Grievance Officer, Grievance Committee Member and Front Desk. One click on Seed Defaults creates them with permissions for the modules your school has on, and you can change any of them.
Yes. Name the role — Fee Counter, Exam Cell, Librarian — and tick its permissions module by module. In the staff app you can also duplicate a role and adjust the copy.
Action by action — over 400 across the modules. Collecting a fee, reversing a payment, seeing the school's fee totals and seeing one child's fee amounts are four separate permissions, so each desk gets only its own.
Yes. A teacher who also runs the exam cell can hold both Teacher and Exam Cell, and gets everything either role allows.
Straight away. When you change a role's permissions, or give or take a role, the next thing that person opens follows the new rules — nobody has to log out.
Yes. The Teacher role marks today's attendance for the classes they are class teacher of. Marking past days and marking any class are separate permissions, usually kept with the office.
Yes, teacher by teacher. In Academics › Classes, open a class's teachers and tap Permissions: parents, personal details, documents, fee status, fee amounts, health, exam results and more, each on or off. Attendance is always open to the class teacher.
Yes. Give a class teacher Fee status without Fee amounts (₹): they see whether fees are paid, partly paid or overdue, but every figure shows as ₹••. In roles, too, seeing the school's fee totals and seeing each child's amounts are separate permissions.
A 4-digit PIN, like a UPI PIN, that staff enter before they collect or reverse a payment — school fees and transport fees — or change a student's fee. Five wrong tries lock it for a while, and it can be reset with a code sent to their phone.
Yes, on the Security page: a PIN every time or once every few minutes on one device; location off, recorded or required, with a campus radius; and alerts to the person on every collection and to admins about unusual activity.
Staff whose role has View Security Activity — usually the principal. It lists every PIN entry, collection and reversal with the person, amount, device, place and result, and counts lockouts, new devices and collections away from campus.
Yes. The Assignments list shows who assigned each role and when. On plans with Audit Logs, every role, permission and assignment change is also in the school's activity trail.
Revoke their role on the Assignments page and their access ends at once. Their sign-in is closed separately, in Users & Access. Inkwelly AI can list former staff who still hold a role.
No. Owners and organisation admins always have full access to every module your school has switched on — roles are for staff.
Yes. An inactive role gives nothing to the people who hold it until you switch it back on. A role can't be deleted while people still hold it, and the ready-made roles can be edited but not deleted.
Yes. Inkwelly AI acts as the person asking, never more: it reads only what their role can read, any change needs the same permission the screen would, and fee amounts stay hidden from people not allowed to see them.
Yes. The Inkwelly staff app has Access & Roles: create, duplicate and edit roles, tick permissions, and assign or revoke them — for staff whose role allows it.
Inkwelly works in English and Hindi, and Inkwelly AI answers access questions in Hindi or Hinglish. The Roles & Permissions screens themselves are in English.
It comes with every plan, from Lite at ₹49 per student per year (GST extra). Plans run ₹49–₹199 per student per year, with ₹0 migration, training and setup. Inkwelly AI is in the Premium plan.
See your roles in Inkwelly.
A free 30-minute demo on the real product. Ask anything — we'll show it live.