The platform, surface by surface

Courses filed into subject groups, searchable, with the date each was added and the date its content last changed. What a person may see here is an allow-list an administrator or their own manager assigns — a new account sees nothing until somebody decides what it should see, which is the safe default rather than the convenient one.

Everything this person can open, with how far through each one they are and a Continue button that returns them to the exact page they left rather than the course home page. Pinned courses, recently visited ones, any class they are in and its last day, and any lab they have been handed.

Every page of the course in reading order, with whether and when this person finished it; every quiz attempt, best beside latest and never overwritten; engaged time; and two different resume targets — where they stopped, and the first gap in reading order, which is a different question.

A class is a name, a start date, a last day, its people and its instructors. The organiser opens it and chooses who is in it; the instructor runs it and chooses which courses it gives access to. Neither can do the other's half, and the instructor can extend the last day at any time — including after it has passed.

Exactly the people assigned to this supervisor, never anyone else — and a learner outside the roster is answered as if they did not exist rather than as forbidden, so identifiers cannot be probed. One payload, two views: by learner, and the same roster pivoted by course. A manager also approves their team's requests; HR sees the same screen without the buttons.

Registration, approval and suspension; which roles someone holds; which supervisor they answer to. A password reset is triggered here and the link is mailed to the account's own mailbox, never shown to the administrator who triggered it.

Which courses exist, whether each is published, which subject group it is filed under, and its language, vendor, level and tags. Filing a course into a group is not cosmetic: the groups are what the visibility allow-lists are written in terms of.

A grid: roles down one side, named actions across the other. Build a role that fits how your organisation is actually shaped, hand someone several at once, and group roles together. What an administrator cannot do is invent an action — the list of actions lives beside the code that enforces them, so a permission nobody checks cannot be created.

Which images a lab runs, in what shape, for how many hours, and whether it may reach the internet at all. Deliberately an administrator's screen and not an instructor's: whoever defines a template is choosing code that will run in your cluster.

Quiz activity across the estate, and a page that compares requests authorised server-side against page views reported by the browser. A person produces roughly one of each; a script produces the first and none of the second. Deliberately not on a supervisor's screen — a page whose columns invite reading a quiet week as misconduct does not belong beside a roster.

Name, language and password. The language choice is the one that follows the person into every course, so a Turkish-speaking learner reads Turkish navigation inside an English course rather than switching sites.