Principle of Least Privilege
Permissions are scoped strictly to daily operational duties. Student staff receive exact front-desk or community tools without exposure to administrative overrides or historical records.
Engineered on the Principle of Least Privilege. A high-precision breakdown of structural permission boundaries across Professional Staff, Desk Assistants (DAs), and RAs / RBAs—balancing front-line operational speed with strict FERPA student privacy.
Every StarRez user role is calibrated to provide exact operational tooling without exposing protected demographic, financial, or judicial student records.
Permissions are scoped strictly to daily operational duties. Student staff receive exact front-desk or community tools without exposure to administrative overrides or historical records.
Student billing ledgers, dispute transactions, behavioral case notes, and sensitive demographic indicators remain 100% isolated from peer student employees.
Professional Staff retain exclusive access to the global Change Log to verify which accounts created, modified, or checked out keys, bookings, and packages.
Front-line operational hub. DAs process couriers, verify external visitors and family members, manage lockout keys, and reference active shift situation logs.
Peer-centered living community support. Family records and incident response logs are intentionally hidden to preserve resident personal boundaries and mentorship trust.
Unrestricted vertical access across academic years. Includes sensitive demographic indicators (Birth Gender, Housing Restrictions), financial ledgers, applications, and audit trails.
Toggle active role telemetry or filter by permission boundaries to inspect exact data exposure rationales across all 13 StarRez modules.
| Interface Tab / Data Scope | Desk Assistant (DA) | RA / Belonging (RBA) | Professional Staff | Institutional & Operational Rationale |
|---|
Why do two student employee roles have different visibility inside StarRez? Their permissions mirror their distinct operational mandates.
Stationed at physical hall reception points where external verification and shift continuity are critical.
DAs interact directly with external visitors, parents, and couriers at the front desk, requiring verified relationship context.
Enables front-desk personnel to reference active desk instructions and incident logs across staff shift changes.
Displays Last Communication timestamp alongside Last Portal Login and active Package counts.
Peer mentors living inside the residential community where personal boundaries and peer trust are paramount.
Withheld to protect resident personal and family boundaries from peers living on the same floor or hall.
Restricted so peer interactions remain centered on belonging and community mentorship rather than administrative surveillance.
Shows only Last Portal Login and Packages, omitting direct university communication history metrics.
All student employees (DAs, RAs, and RBAs) operate under hard-coded security lockouts across four high-sensitivity administrative domains.
Complete student staff lockout from account ledger balances, payment receipts, fee disputes, and rate structure adjustments under strict financial compliance.
Zero student staff visibility into internal conduct files, sensitive staff case notes (Notes & Detail), mediation logs, or administrative restriction flags.
Student staff cannot alter room assignments, execute manual room swaps, modify selection timeslots, or edit future housing application data.
Immutable Change Log and system-wide user activity histories remain exclusively reserved for Professional Staff oversight and forensic accountability reviews.