# Roles and Permissions

Smooth LMS ships four primary learning roles—**LMS Student**, **Course Creator**, **Moderator**, and **Batch Evaluator**—plus standard **System Manager** for full desk control. Roles are created on install (`lms.install.create_lms_roles`) with portal-first defaults (`desk_access = 0`). Permissions on records gate who can publish courses, manage cohorts, grade assessments, and assign mandatory training.

> **Help URL:** [smoothhiring.com/help/lms/getting-started/roles-and-permissions](https://smoothhiring.com/help/lms/getting-started/roles-and-permissions)

---

## Table of Contents

1. [Role summary](/#role-summary)
2. [LMS Student (learner)](/#lms-student-learner)
3. [Course Creator (author)](/#course-creator-author)
4. [Moderator (L&D admin)](/#moderator-ld-admin)
5. [Batch Evaluator](/#batch-evaluator)
6. [System Manager and HR roles](/#system-manager-and-hr-roles)
7. [DocType permission highlights](/#permission-highlights)
8. [API-level permission gates](/#api-level-permission-gates)
9. [Assigning roles to employees](/#assigning-roles-to-employees)
10. [Desk paths](/#desk-paths)
11. [Step-by-step: role rollout](/#step-by-step-role-rollout)
12. [Tips](/#tips)
13. [Troubleshooting](/#troubleshooting)
14. [Related guides](/#related-guides)
15. [HRMS integration](/#hrms-integration)

---

## Role summary

| Role | Desk access | Create courses | Publish / assign mandatory | Manage cohorts | Grade batch work |
|------|-------------|----------------|----------------------------|----------------|------------------|
| LMS Student | No | No | No | Join if allowed | No |
| Course Creator | No | Yes (owned) | Limited | No | No |
| Moderator | No* | Yes | Yes | Yes | Often |
| Batch Evaluator | No | No | No | View assigned | Yes |
| System Manager | Yes | Yes | Yes | Yes | Yes |

Moderators may receive desk permissions via sharing or System Manager pairing; default role record keeps desk off.

---

## LMS Student (learner)

Assigned automatically when HR creates an **Employee** with `user_id` if the user lacks the role (`hrms_integration.on_employee_created`). Students can:

- Browse published courses and cohorts (per LMS Settings).
- Enroll when self-learning is allowed.
- Submit quizzes and assignments.
- View own **LMS Training Assignment** rows (read if owner).
- Receive certificates on course completion rules.

Students cannot access other learners' quiz answers or edit course content.

---

## Course Creator (author)

Creators build curricula in the portal editor or desk forms. Permissions allow create/read/write on **LMS Course**, **Course Chapter**, **Course Lesson** with `if_owner` on some operations—authors manage their own drafts. Creators may use AI generation endpoints when they hold Creator or Moderator role (`lms.lms.ai`).

Creators cannot call `assign_mandatory_training` (Moderator/System Manager only). Pair creators with Moderators for publish workflow if separation of duties is required.

---

## Moderator (L&D admin)

Moderators are the operational super-user on the portal: publish courses, manage any course, delete cohorts, post announcements, run statistics, assign mandatory training, and invite evaluators. APIs frequently call `frappe.only_for("Moderator")` or include Moderator in role tuples.

Grant Moderator sparingly—equivalent to training admin. For desk list access without full System Manager, add selective **Role Permission for Page and Report** or share records.

---

## Batch Evaluator

Evaluators grade cohort submissions, view batch employee lists, and access evaluation charts. `frappe.only_for("Batch Evaluator")` protects evaluation endpoints. Evaluators often are subject-matter experts who should not edit course content.

Assign via user role list or moderator API that adds **Batch Evaluator** role when inviting staff to a cohort.

---

## System Manager and HR roles

**System Manager** bypasses LMS checks for support tasks—use for break-glass fixes on enrollments and certificates. HR **HR Manager** / **HR User** roles do not replace LMS roles; HR still assigns **LMS Student** through integration or manually.

Recommended pattern:

- All employees → **LMS Student**
- Instructional designers → **Course Creator**
- Head of L&D + deputies → **Moderator**
- Department SMEs → **Batch Evaluator** per cohort

---

## record permission highlights

**LMS Course** — System Manager, Course Creator, Moderator: full; students read via portal APIs.

**LMS Batch** — custom `has_permission` on batch; moderators and evaluators see assigned cohorts.

**LMS Program** — custom `has_permission`; members read published programs.

**LMS Training Assignment** — Moderator/System Manager create; student read own.

**LMS Quiz Submission** — staff access patched for instructors printing PDF reports.

Review permissions after migrate; patches update workspace shortcuts and submission access.

---

## API-level permission gates

Examples from `lms.lms.api`:

- `assign_mandatory_training` → System Manager, Moderator
- `get_advanced_statistics` → elevated roles
- Batch announcements → Moderator or Batch Evaluator admin flag
- SCORM chapter delete → permission on Course Chapter

Portal UI hides buttons when API would throw `PermissionError`; desk lists respect Frappe permission queries.

---

## Assigning roles to employees

### Automatic

- Employee create hook adds **LMS Student** when `user_id` present.

### Manual (desk)

1. Open **User** (`/app/user/{email}`).
2. Add roles in Roles table.
3. Save; user re-login to refresh session.

### Bulk

Use **User** data import or script; never assign Moderator via import without review.

---

## Desk paths

| Task | Path |
|------|------|
| User roles | `/app/user` |
| Role list | `/app/role` |
| Learning workspace | `/desk/learning` |
| LMS Settings (guest/signup) | `/app/lms-settings/LMS%20Settings` |

---

## Step-by-step: role rollout

1. Inventory personas (learner, author, admin, evaluator).
2. Create service accounts for integrations without Moderator.
3. Assign **LMS Student** to all employee users (or rely on HR hook).
4. Assign **Course Creator** to designers; test `/lms/courses/new/edit`.
5. Assign **Moderator** to L&D leads; verify statistics and assign training.
6. For first cohort, assign **Batch Evaluator** to SMEs; confirm they cannot delete courses.
7. Document escalation path via System Manager for permission tickets.

---

## Tips

- Separate Creator vs Moderator for SOX-style environments.
- Remove Moderator from departed staff immediately—API access persists until saved.
- Use **Disable Self Learning** plus Moderator assignment for compliance courses.
- Batch Evaluator is cohort-scoped in practice even though role is global.

---

## Troubleshooting

| Issue | What to do |
|-------|------------|
| PermissionError on assign training | Add Moderator or System Manager |
| Creator cannot publish | Moderator must publish or grant publish permission |
| Student sees empty catalog | Published courses; LMS Settings show courses |
| Evaluator cannot grade | Add Batch Evaluator; check batch instructor table |
| HR user no portal access | Add LMS Student; verify user enabled |

---

## Related guides

- [Desk vs portal](https://smoothhiring.com/help/lms/getting-started/desk-vs-portal)
- [First setup](https://smoothhiring.com/help/lms/getting-started/first-setup)
- [Enroll employees in cohorts](https://smoothhiring.com/help/lms/cohorts/enroll-employees)
- [Mandatory training](https://smoothhiring.com/help/lms/courses/mandatory-training-and-validity)

---

## HRMS integration

Role automation depends on [Employee records](https://smoothhiring.com/help/hrms/people/employee-records) linking to users. Onboarding in [Employee Onboarding](https://smoothhiring.com/help/hrms/onboarding/overview) triggers enrollments regardless of manual role assignment if mandatory courses exist. Compliance officers using [Employee Compliance](https://smoothhiring.com/help/hrms/documents-compliance/employee-compliance) should hold HR desk roles, not necessarily LMS Moderator.

## Segregation of duties matrix

| Function | Recommended role | Should not also hold |
|----------|------------------|----------------------|
| Publish compliance course | Moderator | LMS Student only account |
| Author content | Course Creator | Payroll admin (unrelated) |
| Grade cohort | Batch Evaluator | No Moderator if conflict |
| Take training | LMS Student | Moderator on same account |

Review role assignments quarterly when using [Employee records](https://smoothhiring.com/help/hrms/people/employee-records) transfers—remove Moderator from users who moved to individual contributor roles.

## Governance, auditing, and data retention

Training data in Smooth LMS is standard Frappe JSON in MariaDB plus files in `public/files` and `public/scorm`. HR audits typically require evidence of **who** completed **what** by **when**. Export desk lists (**LMS Enrollment**, **LMS Quiz Submission**, **LMS Training Assignment**, **LMS Certificate**) to CSV for sampling. Quiz submission print formats provide question-level detail suitable for safety investigations or harassment prevention audits.

Retention policy should align with HR document retention: keep LMS submissions at least as long as related [Employee Compliance](https://smoothhiring.com/help/hrms/documents-compliance/employee-compliance) records. When employees depart, disable User accounts but retain enrollment history unless legal counsel approves purging. Version course content via amended records or annual duplicated courses so historical completions still reference the correct curriculum year.

System Managers should restrict **Moderator** role membership and enable login activity review on sensitive cohorts (executive leadership programs). Pair LMS reports with HR onboarding status from [Employee Onboarding overview](https://smoothhiring.com/help/hrms/onboarding/overview) to prove training preceded start date when required.

## Frequently asked questions

**Do employees need desk access?** No. **LMS Student** is portal-only by default; send `{site}/lms/courses` links.

**Can one user be both Course Creator and Moderator?** Yes on small teams; larger orgs should separate author vs publish duties.

**How do we handle contractors?** Create User + optional HR employee record; assign training like employees via [Employee records](https://smoothhiring.com/help/hrms/people/employee-records) linkage or direct enrollment.

**What breaks if HRMS is down?** LMS continues serving published content; new hire auto-enrollment pauses until Employee/Onboarding APIs succeed.

**Are certificates legally equivalent to HR compliance rows?** Not automatically—store PDFs on compliance or document types when statute requires.

## Performance and scale notes

Large enrollments (5,000+ users) should batch assign overnight via `assign_mandatory_training` rather than manual enrollment rows. Rebuild website cache after bulk publish. Monitor background workers if email notifications queue heavily. SCORM packages should be optimized zip exports to reduce disk usage during large uploads.

## Additional troubleshooting

| Issue | What to do |
|-------|------------|
| Slow portal after publish | Hard-refresh browser; contact Smooth support if portal styling is broken |
| Wrong user on certificate | Certificate issued to enrollment member—fix User linkage in HR |
| Bulk import partial failure | Check error log; validate Course Instructor rows exist |
| Cohort vs course progress mismatch | Learner must open each course inside cohort; enrollments are per course |
| Timezone confusion on due dates | Training assignment due dates are date-only—communicate timezone in email |

## Operations calendar (recommended)

| Cadence | Action | Where |
|---------|--------|-------|
| Weekly | Review overdue **LMS Training Assignment** | `/app/lms-training-assignment` |
| Monthly | Publish content changelog to employees | Email + `/lms/courses` |
| Quarterly | Role audit (Moderator/Creator) | `/app/user` |
| Annually | Recertify mandatory courses | Re-assign with new due dates |
| After upgrade | Sign out/in; smoke-test `/lms` portal | `/desk/learning` |

## Integration smoke tests with HRMS

1. Create test **Employee** with user — confirm **LMS Student** role.
2. Submit test **Employee Onboarding** — confirm enrollments when courses mandatory.
3. Complete course — attach quiz PDF to test **Employee Compliance** row.
4. Archive evidence in document compliance SOP.

## Support runbook (L1)

Collect: user email, course/cohort name, screenshot of error, timestamp. Check enrollment exists, course published, role present. Escalate to System Manager if SCORM extract failed or permission hooks deny batch access. Reference [Employee records](https://smoothhiring.com/help/hrms/people/employee-records) to fix missing `user_id` before reassigning training.

---

_Last updated: May 2026_