Permissions

Set what each role can see and do. Every change is written to the audit trail with who made it and when. Students always see only their own records; deans see aggregates unless you explicitly grant record-level access.