Kestrel

Part 5. Administration

5.3 Staff and access

Version 1.0 ·Updated 2026-10-07

Next reviewed by 2027-04-07.

Written for a school's staff learning how Kestrel works, the trainers who teach them, and the families using the portal.

Who can sign in, what each person can do, how staff sign in, how a school directory feeds Kestrel and how staff checks are tracked.

Written forITBusiness managerPrincipal and executive

What this group is for

The group "Staff and access" says who signs in and what they can do. Access in Kestrel is a set of capabilities grouped into roles. A person can do anything that any of their roles allows, and nothing else. The screens here give staff accounts their standing and roles, compose new roles, choose how staff sign in and connect the school's directory.

Who uses it

The IT administrator owns these screens. The business manager manages staff accounts and the staff checks. The principal can read the audit trail that records each change made here.

Key ideas

Standing
Whether a person is staff or an administrator. It is separate from roles. Removing a person takes their standing away and keeps the account.
Role
A set of capabilities with a plain reason for the set. Kestrel ships roles such as registrar, teacher, nurse and business manager, and the school can compose its own.
Reach
How far a role's access extends. Each role shows its reach beside it on the roles screen.
Passkey
A sign-in tied to a person's device. A school can require one, so an emailed code alone is not enough.
Group mapping
A rule that gives staff standing and roles when the directory says they belong to a named group.
Kind of check
A staff check the school tracks, such as a working with children check, with who must hold it and how early to warn.

Screens

  • Staff accounts

    /app/settings/people

    Each staff member with their standing, roles and the day they joined.

  • Roles

    /app/settings/roles

    The shipped and school-composed roles, with the capabilities each has and why.

  • Sign-in

    /app/settings/sign-in

    How staff sign in and whether a passkey is required.

  • Directory

    /app/settings/sso

    The school's directory (Microsoft Entra ID, Google Workspace or another), how it signs staff in and which groups give which roles.

  • Staff and accreditation

    /app/settings/staff

    The kinds of staff check the school tracks and who is told as one comes due.

Staff accounts

The table lists Name, Standing, Roles and Since. Each row has buttons. "Roles" opens a dialog where you tick the person's roles and choose "Save the roles". "Make an administrator" and "Make staff" change their standing. "Remove" takes their standing away.

A removed person keeps their account, and "Give {name} standing again" restores them. Only an operator of Kestrel can close an account. The last administrator cannot be demoted or removed, so the school is never left without one.

Composing a role

The roles table shows Role, Reaches, "Why this set" and Capabilities. When none of the shipped roles fits, choose "Compose a role", give it a Name, a Title and the reason in "Why this set", then tick the capabilities it needs. Each capability is described in a plain sentence. A school-composed role can be deleted with "Remove this role". Shipped roles cannot.

  1. Open "Roles" and choose "Compose a role".
  2. Give the role a name, a title and a reason in "Why this set".
  3. Tick the capabilities, reading the sentence beside each.
  4. Save, then give the role to a person from "Staff accounts".

How staff sign in

"How staff sign in here" is either "Code and passkey" or "Passkeys only". A second setting, "Whether staff must sign in with a passkey", is either "Passkey or code" or "Passkey required". Kestrel refuses to close the emailed code while a staff member has no passkey, so no-one is locked out by the change.

When a passkey is required, a session made with a code reaches nothing and is sent to the page that asks for a passkey.

The directory

The "Directory" screen has the groups "The directory", "Signing in" and "Groups". Choose a preset: "Microsoft Entra ID", "Google Workspace" or "Another directory". The protocol is OpenID Connect or SAML. Fill in the fields the directory gives you: "Button label", "Application (client) ID", "Client secret", "Sign-on address", "Directory entity id", "Signing certificate" and "Group claim".

  • "Let the directory issue an account on first sign-in" creates a staff account the first time someone signs in through the directory.
  • "Remove standing from staff the directory has disabled or deleted" runs a nightly check against Microsoft. It never removes the last administrator.
  • "Offer this directory on the sign-in screen" shows the directory's button to staff.

Under "Groups", choose "Add a group" and give a "Group id or name" with the standing and roles its members receive. Group membership is checked at each sign-in. Signing in never removes a role a person already has.

Staff checks

On "Staff and accreditation", "Kinds of check" lists what the school tracks. Choose "Add a kind of check" and give a Code and Name, then who it is "Required of" (staff, teaching, volunteer, contractor or prac-student), the "Jurisdictions accepted", a "Warning period" (90 days by default) and "Who's told" when a check is coming due.

Tasks

Journeys that use this chapter

Settings

The choices on this page are the roles each person holds, the sign-in rule, the directory's connection and its group mappings, and the checks the school tracks. Changing a passkey rule or a directory affects each member of staff at their next sign-in.

Training notes

  • Teach the difference between standing and roles with one example: an administrator with no roles can configure but cannot read records.
  • Ask each new administrator to add a passkey before the school requires them.
  • Use the reasons in "Why this set" as the training script for each role.