Families want visibility. A school needs one answer it can defend.
A guardian sees the people they follow, and for each one only the data categories somebody granted. The permission is the verified relationship itself, checked in the database on every read — never a role handed out by mistake.
How guardian access works in Lurno
In Lurno a guardian's access comes from a verified relationship between two people in one organisation, not from a role. An administrator creates it — or an adult learner grants one over their own data — and it sits pending until somebody with the right to verify reviews it in a queue, with any custody documents attached. Verifying also decides which data categories it carries. Every read is then checked in the database against that relationship: verified, not revoked, not expired, and granted the category the data belongs to. A guardian granted academic sees an overview, activity, competencies and credentials. One granted only schedule sees the timetable — the other tabs are absent from the page rather than shown and empty.
- Data category scoping
- Access granted per relationship and per kind of data, rather than per person. Lurno ships a registry of seven categories — academic, attendance, schedule, behavioural, medical, financial and communications — and a guardianship holds a row for each one granted. The check is a SQL function, `is_active_guardian_scoped(guardian, learner, organisation, category)`, evaluated by the policies that return a learner's data. Two guardians of the same child can hold different categories — after a separation, the ordinary case.
The queue is the point of the design. A request is a claim about a family, and months later somebody has to say who accepted it, when, on which document, and what they narrowed it to. All four are recorded, and every change appends to the audit log that cannot be quietly edited. A guardianship also belongs to the organisation it was verified in, so across a group of schools it never reaches a sibling school.
What a guardian actually sees
People you follow, and how far each has got
One card per person: relationship type, the date it was verified, a chip for each granted category, a completion count. Requests still in review appear too, marked pending.
- A guardian with no staff role gets a one-item sidebar. No programmes, no library, nothing to wander into.
The tabs are drawn from the grant
Overview, Activity, Competencies, Credentials and Schedule. Which exist is computed from the categories on the relationship — the first four from academic, the last from schedule. An ungranted tab is missing rather than disabled, and the check runs again on the server, so a hand-written request gets nothing back.
- Everything is read-only. A guardian can end their own relationship; they cannot change a mark, a schedule or an enrolment.
The same figures the teacher is looking at
Guardian progress reads the certified reporting views staff and learners read, scoped on the server to one learner whose identifier is validated rather than trusted. A parent and a form tutor arguing about a completion figure are at least arguing about the same figure. Reporting is switched on per organisation.
The reporting layerAn adult decides for themselves, in writing
A learner over 18 attests once, then grants a parent, partner or mentor scoped access to their own data, with an optional expiry. The wording they agreed to is stored verbatim, so rewording the interface later cannot rewrite what they consented to. The invitation is a single-use link that dies after seven days.
How a guardianship starts, and how it ends
- 01
An administrator raises it
From a learner's record or the guardianship queue: pick somebody already on the platform, or invite an email address that is not. An invited guardian is linked once they accept and sign in.
- 02
It waits in the queue
Guardian, learner, relationship type, whether custody documents are attached, when it was requested. Creating and verifying are different permissions, so a front desk can raise requests while approval stays with the registrar.
- 03
Verifying decides the categories
The wizard pre-checks a recommended set and lets the reviewer narrow it. Shared custody is settled here rather than in a support ticket: one parent leaves with academic and schedule, the other with academic only.
- 04
Access begins, and stays conditional
Nothing is baked into a session or token. Each read re-evaluates the relationship, so revoking one takes effect on the next query, not the next sign-in.
- 05
Either side can end it
The guardian or the learner can end it without asking anybody, and so can an administrator. It is recorded with a reason, and the dialog says outright that the other party is not notified.
Seven data categories. Two have a surface today.
Only the two with a working surface behind them can be granted. A tick box that shows a parent nothing would tell an administrator they had done something they had not.
| Capability | What the category covers | What the guardian sees | Grantable today |
|---|---|---|---|
| AcademicThe overview shows enrolment and completion state. A per-assessment mark breakdown is not in the portal yet. | Grades, assessments, the work behind them | Overview, Activity, Competencies, Credentials | Yes |
| Schedule | Timetable and upcoming events | Schedule | Yes |
| Attendance | Daily attendance, lateness, absence | — | No |
| Behavioural | Disciplinary notes, incident reports | — | No |
| Medical | Health forms, allergies, emergency contacts | — | No |
| Financial | Invoices, payment history, fees | — | No |
| Communications | Messages between the school and the guardian | — | No |
The other five are real rows with real rules behind them, so adding one is a change of setting rather than a rebuild.
What the institution keeps hold of
A name attached to every decision
Who verified it, when, against which documents, and what they narrowed it to — on the relationship, not in somebody's inbox.
Raising and approving are separate rights
Two distinct permissions in the catalogue, and either can be granted at a branch of your structure so it cascades down that branch only.
Nothing changes without a trace
Creation, verification, narrowing, revocation and expiry each append to the audit log under a fixed action name. Rows are appended, never updated.
Your words for it
An organisation that says mentor or caregiver renames the term and the portal follows — in multiple languages, right-to-left included, to WCAG 2.1 AA.
Manager and sponsor of record
Corporate relationships are modelled the same way. A sponsor's read follows the enrolment they funded rather than a person's whole learning history.
Questions buyers ask
See it with a real family on screen.
We will raise a request, verify it with the categories narrowed, then take one away and watch the tab disappear.