Roles and permissions

Well, things like course categories, courses, activities and blocks are things that are defined by the admin (or teachers), and then Moodle automatically makes a context for each of these things. (If you know object oriented programming, you can think of context as a base class for thinks that are a part of a Moodle site.) Each context (apart from system) has a parent, so the contexts form a tree structure.

Probably the most familiar tree structure is the files on your hard disc arranged into folders. You could think of Moodle contexts the same way - it might help to think about your contexts as having path names like

As far as the roles system is concerned, there is no difference between the different types (system, category, course, ...) of context. It is only when you try to interpret what your role settings mean that you end up thinking about the different types. The roles systems just cares about this tree of contexts.


Yes roles are assigned in a context. And a particular user can have any number of roles assigned in any context - but by far the most common cases none or one role assignment for a user in any context.

Stuff that happens in one context affects that context and all the other contexts underneath. (I am thinking of a picture, like the one you used, with the system context at the top.) So take your example, if you assign someone to be a teacher in a course category, then it is not necessary to assign them the teacher role in courses within that category. However, it is still possible to do so. You can always make any role assignments you like in any context, whether or not it makes sense to do so. (So, yes, someone could be assigned both Teacher and Student role in the same course, although this is probably not a useful combination.)

However, in this case, it is not strictly accurate to say that the user is automatically assigned as a teacher in every course (and activity) in the category. It is better to say that the user is assigned as a teacher in the category, and as a result, they inherit teacher permissions in every context within that category.

A more useful example is: suppose Fred is a student in course CF101, and you would like Fred to be able to mooderate a particular forum, say Discussion1. Then you can assign Fred the Non-editing teacher role in the context of Discussion1. The effect of this will be that Fred's pemissions in that forum will be a combination of the student permissions that are inherited from the course context, and the teach permissions granted in the forum context.

Actually, I am oversimplifying slightly, because everybody who has logged into a Moodle site automatically has the role Logged in user in the System context, which therefore gives some permissions in all contexts in the system. So Fred's permissions in the forum will actually be a three-way combination.

You may well ask exactly how are all the different permissions combined. If you really want to understand the answer to that, including how role overrides affect things, you need to read How_permissions_are_calculated. However, in most simple cases, it just works the way you expect. Most roles just allow certain permissions, with all the others not set. So the combined roles just allows all the things that are allowed by any of the roles.


I hope that helps. One of my tasks for Moodle 2.0 is to improve the interfaces for managing roles, to try to make the system more self-explanitory.