Appropriate Account Role Permissions for Graduate Assistant

[sendres]

I'm the Canvas admin for my university and director of our Learning Technologies team. We're planning to hire a graduate assistant, who would be the first student worker we've had in our area. Their role would be to help with support tickets and, depending on their skill set, potentially help me with automating and documenting our processes.

I'm working my way through the Canvas Account Role Permissions document and designing an account role with permissions for the grad assistant. My thought is to disallow access to other students' submissions and grades and to unneeded or potentially destructive permissions like SIS import.

Have you hired a grad student for similar work? How did you balance their need for access to do work with the need for a stable/secure production environment?

[dbrace]

Hi @sendres,

My institution does not have a student worker in our Department of Online Learning (which manages our Canvas environment and is separate from our IT Department).

Depending on who your student worker will be helping (students, teacher, and/or staff), I would be careful not allowing them to have access to view student submissions. Even if they are only helping students, they might be in a situation where they are asked to confirm whether or not a student submitted something (and that inquiry could come from a student or a teacher).

I am interested to see what others have implemented.

-Doug

[chriscas · Accepted solution]

Hi @sendres,

This is an interesting question, and one where there may be no single "correct" answer...

One thing I'd suggest to begin with is to create a different user account to use for the student's admin access.  I say this because if you use the same account they traditionally use as a student, they're going to have a edit access to a lot of things when they are just trying to do their student work, which is likely not ideal.

When you're looking at permissions, I'd honestly start them off with the bare minimum you think would allow them to do the work you're going to assign.  As you already mentioned, i'd likely not grant access to grades, sis, LTIs, and maybe more.  Starting with bare bones will give a good base, then if the student says they are not able to access things you need them to, you could adjust the permissions at that point.  Better safe that sorry, in my opinion...

-Chris

[sendres]

Hi @chriscas,

This aligns with my thought process. We do give student workers separate accounts (sw_username) already, so your first point is well taken. I've also converged on a "dynamic" approach to permissions—starting with minimal settings, adding permissions as needed for projects, and revoking them (if appropriate) when a project concludes. I plan to keep an audit trail of what/when/why permissions are added to make it easier to unroll them later if needed.