#Roles and Permissions

Rudder Virt has four roles, listed below from least to most privileged. Each role inherits everything the role beneath it can do.

#Student

A student belongs to one or more classrooms. They can:

• See the classrooms they are enrolled in.
• Open and start the modules released to those classrooms.
• View their own attempts and scores.

Students cannot view other students' work, see the module library, or access any organization-level configuration.

#Teacher

A teacher is a member of an organization with a classroom-level role. They can do everything a student can, plus, for the classrooms they are assigned to:

• Add or remove students.
• Release modules from the library to the classroom.
• View the classroom's gradebook, including every student's attempts and scores.
• Open helpdesk tickets students filed during a module.

A teacher's authority is per classroom. Being a teacher in classroom A does not give you any additional rights in classroom B unless you are explicitly assigned there. Teachers do not edit the module library; that requires org admin.

#Org admin

An org admin manages an organization. They can do everything a teacher can in every classroom in the organization, plus:

• Create, edit, share, and archive modules in the library.
• Create and configure classrooms.
• Manage organization-level users (promote a user to teacher or admin, deactivate accounts).
• See the organization's credit balance and reload virts.
• Configure the organization (name, default settings, the deployment zone it runs in, though changing the zone is rare and disruptive).

Org admin does not cross organization boundaries. If your organization shares a module with another organization, that does not give you any rights in the other organization's library.

#Superuser

A superuser is a Rudder Virt operator role. It is not visible to organizations. Superusers can:

• Register and manage deployment zones.
• See and act on every organization, classroom, and module on the platform.
• Access audit logs, job statuses, and platform-wide tooling under the superuser admin panel.

Most readers of these docs will never have this role. If you operate a self-hosted deployment, your platform team retains it.

#Quick lookup