- as admin, create a new role CanAdd, giving it moodle/course:managefiles permission.
- as teacher, assign the CanAdd role to selected students
I call a role like CanAdd a "mixin" because it can be combined (or "mixed in") with other roles, like Student, thereby adding a small set of related capabilities (often, only one capability, as in this example).
Note that the Student role is not changed because to do so would affect all Students.