# Administrator manual

## Initial administration

Create institutional structure in parent-first order: institution, campus/study
centre, faculty, department, programme, session, semester, and level. Assign users
the least-privileged tenant role; do not grant permissions directly unless approved.
Suspension immediately invalidates the user's next authenticated request.

## Operational sequence

- Admissions: configure a cycle and requirements before applications open.
- Academics: publish versioned curricula before offerings and registration periods.
- LMS/CBT: allocate staff before publishing content or examinations.
- Results: use the full submission, departmental, examination, dean, board, and
  publication trail. Reopen only with a recorded reason.
- Finance: publish fee schedules, issue invoices, verify manual evidence, and use
  reversal/refund actions rather than editing ledger rows.
- Documents: verify payment and approval before generating official PDFs.
- Graduation: complete mandatory clearance before candidate nomination; approve and
  publish lists before conferral.
- Research: assign supervisors and respect proposal, ethics, submission, defence,
  correction, and repository gates.
- CMS/communication: publish only reviewed content. Academic, finance, admission, and
  security announcements are mandatory.

## Sensitive data

Medical notes, pastoral/character assessments, CBT answers, payment evidence,
research manuscripts, transcripts, and certificates require specific permissions.
Never place private files under `public/`.

## Routine review

Daily: failed jobs, payment callbacks/webhooks, pending approvals, disk capacity, and
readiness. Weekly: login audits, suspended accounts, queue failures, reconciliation,
backup completion, and expiring admission/registration windows. Monthly: role review,
restore test, dependency advisories, storage growth, and database slow queries.

Development seed credentials are documented in the README and must never be created
in production. `AccessControlSeeder` creates role demo users only in local/testing.