Afisena
In the week before exams, three people ask for what sounds like the same thing.
The head teacher wants to see how year 8 is doing. One teacher is covering a colleague who is away for a month. Another has offered to help mark the written answers — only the marking, nothing else.
All three say "I need access to that subject". All three need something different, and giving them one answer is the fastest way to arrive at a school where everyone can see everything.
Three answers, not one
Access to a subject is granted per subject, and it comes in three shapes.
Observer may open the subject. The material, the structure, how the course runs. Not the marks.
Grader may open it and may mark. May not change what is in it — no new chapters, no edited questions, no moved deadlines.
Co-teacher may open it, mark, and change it. This is the one that means "standing in".
Lay those against the three requests and the answer stops being a judgement call: the head teacher is an observer, the cover is a co-teacher, the colleague helping with the marking is a grader. Nobody needs more than they asked for.
The first one is the one that usually goes wrong
Observer is the easiest role to over-grant, because the person asking is usually senior to you and the request sounds entirely reasonable.
But "see how year 8 is doing" and "read every individual student's marks" are two different things, and only one of them was asked for.
So the gradebook is guarded on the permission to mark, not the permission to view. An observer opens the subject and finds no gradebook button at all. If they knew the address of the export and typed it in directly, the file would refuse them too — the page and the file it offers are guarded by the same condition, so the two cannot disagree about who belongs.
This is not about distrusting a head teacher. It is about access granted once lasting a long time, and about nobody remembering, a year from now, why that account can see everything.
Why you cannot design these roles yourself
A school cannot invent a new role with its own arrangement of permissions. That is a decision rather than an unfinished feature.
Someone's role is carried in their login session, which lasts days. If schools could rearrange permissions freely, there are two possibilities and both are bad: the change takes effect only once the session expires — which means revoking access is not immediate, precisely when you most need it to be — or every page request has to go back to the database and ask again.
Three fixed shapes that can each be explained in one sentence are more useful than a permission builder that nobody dares to touch once it is set up.
What is worth checking today
Not who has an account. Who has access to a subject that is not theirs, and whether the reason still holds.
The teacher who covered a month of leave is still a co-teacher until somebody removes them. The colleague who helped mark last term's exams is still a grader. Nobody did anything wrong; there is simply no longer a reason for either of them to be looking.
The run-up to exams is when access requests arrive in bulk. It is also the most sensible moment to clear out the ones that arrived before.