6 min read · Updated 2026-10-18
In short
Give every staff member their own sign-in and a role that matches their job, then add or remove single permissions for the few people who need something different. Limit campus managers to their own campuses, require two-step sign-in for anyone who handles money or families' details, and switch a sign-in off the day someone leaves.
In a lot of centres everyone signs in as the owner. It starts innocently: one login on the front desk computer, shared with a new receptionist in a busy week, then a tutor who needed to check a timetable. A year later nobody can say who changed a family's price, a casual tutor who left in March can still open every parent's phone number, and the owner is nervous about every new hire. The fix is not a policy document. It is giving each person their own sign-in and the access their job needs, and no more.
Start from the job, not the person
Most people in a centre do one of a handful of jobs, so start with roles. A role is a bundle of access for a job, and most of your staff should hold exactly one, unchanged. Exceptions are for the few people whose job really is different, and they should be visible.
- Tutor: their own lessons, the roll, homework and their students' learning.
- Receptionist: enquiries, bookings and the families' details the front desk needs.
- Finance: invoices, payments, pay runs and pay rates.
- Marketing: enquiries, broadcasts and the centre's design work.
- Compliance: working with children checks, incidents and the audit trail.
- Admin: the day-to-day running of the centre, or of their campuses.
- Owner: everything, including who can do what.
XTutio ships with these roles, and your centre invites its own staff by name, email, job and optional campus. The owner role is never handed out by invitation. Someone who signs up on their own arrives with no access at all until an admin gives them a role, so a stranger who finds your sign-in page sees nothing. The steps are in our guide to staff roles and two-step sign-in.
Permissions in plain words
Access settings only help if the person setting them understands them. A list of codes such as families.edit invites guesswork. Each permission should say, in a sentence, what it lets someone do, and should warn you when it reaches something private: a parent's phone number, a home address, a child's results, money or pay.
In XTutio every permission has a plain name and one sentence of what it unlocks, grouped by area, with a note on the sensitive ones. Each role is shown as a card in those words, and each person's page answers "What can they do?" in the same language. When one person needs something extra, or should not have something their role gives, you change it for that person on one screen with one save.
Use the role when
- Everyone in that job needs it
- It is part of the job description
- A new hire should get it on day one
Change one person when
- Only they need it, for a reason
- It is a temporary cover arrangement
- Their role gives them something they should not have
Guardrails on who can change access
The person who changes access is the person most worth protecting. A few rules stop an honest mistake turning into a problem, and XTutio holds every one of them:
- Nobody can give someone more than they hold themselves
- Nobody can change their own permissions
- Changing access asks for two-step sign-in every time
- Every change is written to the audit log before it is saved
- An admin limited to some campuses can only change people at those campuses
- The owner role always keeps the access to manage the centre's people
Campus limits matter most in a centre with more than one site. An admin restricted to their campuses sees and changes only the families, students and staff there, and an import they run can only bring people into those campuses. Our article on running a multi-campus centre covers what to keep central.
Two-step sign-in for anyone near money or families
A password alone is not enough for a sign-in that can open every family's contact details. In XTutio owners, admins and finance staff must use two-step sign-in with an authenticator app, and a centre can require it of every staff member, tutors included. Anyone who must use it gets a grace period your centre chooses, ten single-use recovery codes, and an admin can reset it from their user page. The most sensitive actions, such as changing access or exporting data, ask for it even inside the grace period. Security and data sets out the rest.
When someone leaves
Switch the sign-in off on the day, not when you next remember. On a person's user page, Access switches their sign-in off: they are signed out and cannot sign in again, and nothing they did is deleted, so the record of their lessons and notes stays. You cannot switch off your own sign-in, and the centre always keeps at least one working admin or owner, so nobody locks the centre out by accident.
Check what each role really sees
Before you trust a set-up, look at it through someone else's eyes. In XTutio the owner can use View as, from their own menu, to see the portal as a tutor, a receptionist or another staff role. It is look only: nothing can be changed while viewing, a banner stays on screen with a way back, and it ends by itself after eight hours. It is the quickest way to find a page a role should not reach, and a good habit before a new tutor's first day, alongside our checklist for onboarding new tutors.
Questions centres ask
- Should tutors share a login at the front desk?
- No. Every staff member should have their own sign-in, so you can see who did what, switch one person off without affecting anyone else, and give each person only the access their job needs.
- What is the difference between a role and a permission?
- A role is a bundle of permissions for a job, such as tutor or finance. A permission is one thing a person can do, such as seeing families or changing pay rates, and can be added or removed for one person when their job differs from the role.
- Who should have two-step sign-in?
- Anyone who can open families' details or money, which in practice means owners, admins and finance staff at least. Many centres require it of every staff member, tutors included.
