We are currently evaluating our permissions regarding adding people to courses. We are curious what other institutions do and what your policies are surrounding this functionality.
We do not let teachers add/remove students in courses. Creation of student enrollments is an Enrollment Services function and requires payment of tuition and fees; and our integration between Canvas and our student Information system (SIS) manages the enrollments of students into Canvas courses based on the SIS. As Admins, we manually add/edit enrollments by exception when it cannot be managed by the integration.
Our school does the same as Kelly's. If individuals need adding (not the usual enrollment at the beginning of the semester), the Admins manually add those individuals.
We have 1 synchronised section in Canvas that contains teachers from our SIS system, and multiple synchronised sections with students from SIS.
The first section in every course is empty and is called: 1. manually added people
Teachers can add students (and other teachers) to their course. The synchronised sections will be synced every night with our SIS system, but the 1st section and other sections created in the course will not.
Teachers do use this functionality from time to time to give access for specific reasons:
We (Temple University) allow teachers to add enrollments to courses, although they have to enroll them into non-SIS sections for everybody's sanity.
For courses/sections enrolled via SIS, we developed an LTI that allows instructors to manage the provisioning & enrollment of their Banner listed courses, so they can decide whether or not to merge sections into a single course or to have all sections provisioned as separate courses. Faculty are required to provision their own courses in this way (unless the department has a coordinator who manages courses for faculty).
In addition to SIS created courses, an employee (faculty and staff) can create a few different "ad hoc" shells:
We also developed a tool for letting instructors search our LDAP directory for invite-less enrollments (the user isn't invited, just enrolled via the API (if the faculty wishes to send an invite, there's a checkbox).