OptClass Student Access

Students in Optserv's School (OptClass) workspace operate under a completely separate access model from staff. They are not part of the staff RBAC hierarchy (Admin, HR, Manager, Employee) and are actively blocked from the staff web application.

Students are not staff

In the staff RBAC model, roles define what a person can do within company HR operations. Students have no place in that model — they are learners or trainees, not employees managing HR workflows.

As a result:

• Students do not have an Admin, HR, Manager, or Employee role
• Students cannot log into the staff web application (app.optserv.ai)
• Students access Optserv through a separate, kiosk-style interface designed for their experience

How students are blocked from the staff app

Student blocking uses defense in depth:

1. Metadata check — user metadata is checked on login; accounts without staff claims are rejected at the authentication layer
2. UI redirect — if a student account somehow reaches the staff app, a metadata-based check redirects them away immediately
3. RLS — student accounts have no company-scoped staff access; database queries return no staff data

This is not just a UI toggle. A student cannot access staff data even through direct API calls.

What students can do

Students access their own portal, which includes:

• Viewing their schedule (assigned groups and session times)
• Checking their session balance (remaining sessions purchased)
• Viewing their attendance history

Students do not see:

• Other students' data
• Staff information
• Company settings or any HR data

Staff view of students

Staff (all four roles — Admin, HR, Manager, Employee) can access the School workspace when it's enabled. From there, staff can:

• Create and manage student profiles
• Assign students to groups and schedules
• Record attendance and track session balances
• Manage teachers and 1:1 sessions

Managing student limits

If you're approaching the student or teacher cap, you'll need to upgrade. Limits are checked at the time of creation — you won't lose existing records if you downgrade, but you won't be able to add new ones beyond the limit.

See School Limits for more detail.