Overview
Snorkl uses role-based access control combined with organization and class membership to determine what users can see and do. All permissions are enforced on the server to prevent unauthorized access.
Users can only access data associated with their organization, and access to student work and activities is further restricted based on class membership where applicable.
User Roles
Snorkl currently supports the following core roles:
Students
Can access activities assigned to their classes
Can view and edit only their own submissions
Cannot view other students’ submissions unless explicitly enabled by a teacher
Cannot access teacher-only content
Teachers
Can create and assign activities to their classes
Can view student submissions only for students in their classes
Can provide feedback on student work
Cannot access data from other organizations or unrelated classes
Organization Administrators
Can manage users within their organization
Can view organization-level teacher usage metrics
Can view student work for users within their organization
Cannot manage or modify classes for teachers
Cannot access data outside their organization
Data Sharing Scope
Snorkl is designed to minimize data exposure and prevent unintended sharing.
Organization boundaries
Users can only access data belonging to their organization.
Cross-organization access is not permitted.
Class-based access
Teachers and students only see data tied to classes they are members of.
Student submissions are visible only to the student, their teacher(s), and organization administrators.
Student-to-student visibility is disabled by default and must be explicitly enabled by a teacher.
No public sharing
Student work and class content are not publicly accessible.
Sharing requires explicit user action within the platform and remains restricted to authorized users.
Permissions Enforcement
All access controls are enforced server-side
API requests are validated against:
User role
Organization membership
Class membership (where applicable)
Frontend permissions mirror backend rules but do not grant access on their own
This ensures users cannot bypass restrictions through direct links or modified requests.
Privacy and Security Principles
Snorkl follows these guiding principles:
Least privilege: users only have access required for their role
Explicit boundaries: organizations define clear access limits
No implicit sharing: access is granted through roles and membership, not assumptions
Summary
Users are restricted by role, organization, and class
Students only see their own work
Teachers only see work from students they teach
Organization admins can view usage metrics and student work within their organization
Organization admins cannot manage teacher classes
All access controls are enforced on the backend
No data is shared across organizations