Access Control
6 roles, permissions enforced at the database layer
Education
School Management System
One system, six kinds of people, one source of truth — administrators, principal, teachers, students, security, and student council each see exactly what's relevant to them, with permissions enforced at the database level, not just hidden buttons in the UI.
RBACRow-Level SecurityGPS TrackingSchedulingAttendanceRecords
School Management System
The Challenge
A growing school with an international student body was running on a patchwork of paper registers, spreadsheets, and disconnected tools — attendance recorded one way, scheduling another, field trips relying on manual headcounts, staff and student records living in files that didn't talk to each other. The deeper problem wasn't any single tool: every one of the school's six kinds of users needed something different from the same underlying information, and with no shared system, each of those needs meant someone doing manual work to piece it together.
The Solution
SMIS is a single platform with one login experience for the whole school but a different view for everyone who uses it. Administrators, teachers, students, security staff, and the student council each see exactly what's relevant to them and nothing they don't need — attendance, scheduling, academic records, and field trips all live in one place, updated in real time, with a clear record of who did what.
The Engineering
Six distinct account types (Administrator, Principal, Teacher, Student, Student Council, Security) sit on PostgreSQL with row-level security policies scoped per role, so access control is enforced in the data layer itself rather than hidden behind UI conditionals. Off-campus trips carry live GPS tracking with checkpoint logging tied to each trip and its student roster, so a trip's progress is verifiable in real time rather than reported after the fact. A seasonal scheduling engine shifts lesson timings automatically between summer and winter timetables, removing a manual re-entry job every term. Student and staff attendance run through separate pipelines that each require a verifying user rather than a self-reported entry, producing an auditable trail on both sides.
Unified GPS trip tracking
Capacitor Geolocation
Geolocation.watchPosition (native)
Browser Geolocation API
web
→
RxJS BehaviorSubject<LocationData[]>
each reading tagged 'web' | 'native'
→
Trip Tracking UI
identical logic, any device
One scanner component, four contexts
@zxing/ngx-scanner
shared scanner component
Teacher Attendance
Teacher Trip Check-in
Security Gate
Student Council Home
Built For
AdministratorsPrincipalTeachersStudentsStudent CouncilSecurity
The System
A typical day: security checks students in at the gate, teachers take attendance from their own dashboard, and the schedule reflects the current term automatically. When a class heads out on a trip, the school sees live checkpoints as students move through the day rather than waiting for a phone call. The timetable data model is built for genuinely concurrent electives: each day/period slot holds an array of subjects rather than a single value, so multiple elective classes can run side-by-side in the same period without restructuring the database as the course catalog grows. Fixed non-teaching blocks (assembly, breakfast, lunch) share the same underlying schema but render full-width.
Principal / Admin campus overview
Teacher attendance
Timetable with concurrent electives
Student ID card
Security gate check-in
GPS trip tracking
The Outcome
SMIS replaced a patchwork of spreadsheets and paper processes with one governed system serving six distinct user roles from a single, permissioned platform. Attendance tracking is automated for both students and staff with a verifiable audit trail, and off-campus trips carry real-time visibility through GPS checkpoint tracking rather than a wait for a phone call. The timetable natively supports parallel elective scheduling, so the school can keep adding elective options without the schedule needing to be rebuilt each time — one source of truth for scheduling, academic records, and administrative documentation.
Visibility
Live GPS checkpoints replace after-the-fact trip reports
Scalable Data Model
Native support for parallel elective scheduling
Technologies
Next.jsPostgreSQLRow-Level SecurityReal-Time GPS TrackingRole-Based Access Control
Some systems and client engagements are subject to confidentiality agreements. Screenshots shown here have been selected or generalized to avoid exposing private client information.
Have a system like this in mind?
Let's scope the architecture and plan the build.