User Roles & Permissions

Attestation Core decides who can do what using WordPress capabilities. These are named permissions that WordPress checks before showing a screen or saving a change. This page covers:

• the people who use the plugin, and what each of them sees
• how staff get portal access (it’s not decided by their WordPress role)
• how to set up a Department Coordinator (Pro)
• a full Capabilities reference for every plugin capability

Every action that changes data also passes a security-token (nonce) check, so a capability alone is never enough to change records from outside the plugin’s own screens.

---

The people who use Attestation Core

Who	Where they work	How they get access
Organisation Administrator	WordPress admin: Attestation Core menu	The WordPress Administrator role. The plugin adds its admin capabilities to this role when it’s activated
Staff member (generic wording), or Trainer/Assessor with the Pro RTO industry setting	The staff portal pages on your website	Their WordPress user is linked to an active compliance profile. Their WordPress role doesn’t matter
Department Coordinator (Pro)	WordPress admin, limited to their departments	You pick them as a coordinator on a department. This adds a coordinator capability to their user

---

Organisation Administrator

A WordPress Administrator sees the whole Attestation Core menu.

Free plugin:

• Dashboard
• Compliance Profiles
• Evidence
• Documents
• Reports
• Notifications (the notification log)
• Action Log
• Settings
• the hidden Setup Wizard

Pro plugin adds:

• Matrix and Units (RTO industry setting)
• Plans
• Departments
• Staff and Upskilling Plans
• Calendar
• Qualifications (RTO)
• RTO Milestones and Validation Panels (RTO)
• these extra Settings tabs: Branding, Escalations, SMS, Scheduled Reports, Webhooks and Licence

What’s on each screen is covered in Welcome and overview and the feature guides. See also the Organisation Administrator guide.

Other admin roles. Only the WordPress Administrator role receives the plugin’s admin capabilities. If you want, say, an Editor to review evidence, give that role the capability you need (for example attestation_core_validate_evidence) with a role-management plugin. Use the Capabilities reference to choose.

---

Staff members (Trainer / Assessor)

How portal access works

A person can use the staff portal when both of these are true:

1. They have a WordPress user account, and
2. That user is linked to a compliance profile whose status isn’t Archived.

When both are true, the plugin grants the portal capabilities automatically each time the person loads a page. It doesn’t change their WordPress role. So someone who is also a LearnDash group leader, TutorLMS instructor or WooCommerce customer keeps that role and its access. When you archive a profile, portal access stops straight away. An Inactive profile keeps portal access.

You can check this on any profile: open it in Attestation Core → Compliance Profiles and expand Capabilities granted under the portal access section.

The “Trainer / Assessor” WordPress role

On activation the plugin creates a WordPress role called Trainer / Assessor. It’s a label only. It carries the basic WordPress “read” permission and no plugin capabilities. It’s useful for two things:

• spotting portal users in Users → All Users and in the Linked WordPress user list, where they’re tagged
• automatic profile creation: when you create a new WordPress user with this role and no profile exists for their email address, the plugin creates a compliance profile for them

Changing an existing user’s role to Trainer / Assessor doesn’t create or link a profile.

What staff see

• The portal pages you’ve set up. Free: Dashboard, My Profile, My Documents, Submit Evidence and My Evidence. Pro adds: Annual Plan, My Compliance Record, My Compliance Calendar and Upskilling Plan. See The staff portal.
• After logging in, they’re taken to the portal page mapped as Dashboard in Settings → Portal pages. The WordPress admin bar is hidden for them on the front of the site.
• Only their own records. Every download goes through an ownership check.

What staff can’t do

• Open any Attestation Core admin screen
• See another person’s profile, documents, evidence or plans
• Validate their own evidence or approve their own plan
• Change their workforce categories, credential category or unit assignments. My Profile is a read-only snapshot

See the Trainer / Assessor guide.

Administrators who also have a profile

An administrator can be linked to a compliance profile too, for example a training manager who also teaches. They get the portal capabilities as well as full admin access, and they aren’t redirected to the portal at login.

---

Department Coordinator (Pro)

🔒 Pro feature — requires the Pro plugin.

A Department Coordinator manages compliance for the people in their own departments without full administrator access. It’s not a separate WordPress role. When you choose someone as a coordinator, the plugin adds a coordinator capability to their user and records which departments they cover.

Who can be a coordinator

On a department’s edit screen, the Department Coordinators list shows users who are linked to an active compliance profile marked Leadership / manager in their workforce categories. People already assigned as coordinators also stay visible there. To make someone eligible, tick Leadership / manager on their compliance profile and link their WordPress user.

Assigning a coordinator

1. Go to Attestation Core → Departments and click Edit on the department.
2. Under Trainers, select everyone who belongs to the department (hold Ctrl or Command to select several).
3. Under Department Coordinators, select one or more users.
4. Click Save Assignments.

The coordinator capability is added automatically. If you remove someone from every department they coordinate, or delete their last department, the capability is removed. See Departments and department coordinators.

What a coordinator sees

Coordinators reach the admin area at /wp-admin/. Because they also have a compliance profile, they land on the portal dashboard when they log in, so they’ll need to go to /wp-admin/ from there.

Screen	Access
Compliance Profiles	Only people in their departments. A notice says “You are coordinating Nursing — 12 trainer profiles in your scope.” They can edit and archive those profiles, but Add profile and Import profiles are hidden
Evidence	Their departments’ submissions. They can validate and return them
Plans	Their departments’ annual plans. They can approve and return them
Documents	Their departments’ documents. They can verify, download and manage them
Staff	Administrative staff in their departments. They can’t add new ones
Matrix (RTO)	Built from their departments’ profiles. The matrix is briefly cached, so for a short time after a change it can show the same view another user saw. Don’t rely on it as a department filter
Upskilling Plans	The menu item appears, but the list isn’t limited to their departments in 1.0.0. Leave upskilling plan review to administrators

Coordinators don’t see:

• Dashboard
• Reports (including the audit bundle and PDF/XLSX exports)
• Calendar
• Qualifications
• Units
• Departments
• Notifications
• Action Log
• RTO Milestones and Validation Panels
• Settings, including the Licence tab

How the department limit is enforced

The limit is checked on every request, not just hidden in menus:

• Lists (profiles, evidence, plans, documents) are filtered to their departments, including the counts.
• Opening or changing a record is allowed only if the record belongs to someone in their departments. In a bulk action, one out-of-scope record blocks the whole action.
• Creating new records (a new profile, an import or an unscoped save) is refused.

If the Pro licence lapses past its grace period, coordinators keep their limited access to Compliance Profiles, Evidence and Documents. The Pro screens (Plans, Staff, Departments and so on) are hidden until the licence is reactivated. If the Pro plugin is deactivated, coordinators lose all admin access.

See the Department Coordinator guide.

---

Capabilities reference

Every capability the plugin uses is listed below. “Admin” means the WordPress Administrator role. “Staff” means any user linked to an active (non-archived) compliance profile, whatever their WordPress role. “Coordinator” means a Pro Department Coordinator, limited to their departments.

Admin capabilities

Added to the Administrator role when the Free plugin is activated.

Capability	What it allows	Admin	Staff	Coordinator
attestation_core_manage_plugin	Open the Attestation Core Dashboard	✓	–	–
attestation_core_manage_trainers	Compliance Profiles: add, edit and archive profiles, credentials, Import profiles and the CSV template. Pro: Matrix, Staff, and unit assignments on a profile	✓	–	✓ (own departments; can’t create)
attestation_core_manage_units	(Pro) Units screen, unit CSV import and template, training.gov.au unit sync	✓	–	–
attestation_core_manage_documents	Documents screen: verify or unverify, download any document, delete. Saving document types	✓	–	✓ (own departments)
attestation_core_validate_evidence	Evidence review queue: validate, partially validate or return, and download evidence files. Also allows recording a Sign & Attest declaration	✓	–	✓ (own departments)
attestation_core_manage_plans	(Pro) Plans: approve, return, reopen and delete drafts. Upskilling Plans	✓	–	✓ (annual plans scoped; see note above about upskilling plans)
attestation_core_view_reports	Reports and CSV download. Pro: PDF and XLSX export, the audit preparation bundle, Calendar, Qualifications	✓	–	– (deliberately excluded)
attestation_core_manage_settings	Settings (all tabs except where noted below), Notifications log, Setup Wizard, Send test email. Pro: Departments, Validation Panels, RTO Milestones, and the Branding, Escalations, SMS, Storage, Scheduled Reports and Webhooks tabs	✓	–	–

Staff portal capabilities

Granted automatically while the person is linked to an active profile. Never stored on a role.

Capability	What it allows	Admin	Staff	Coordinator
attestation_core_submit_evidence	Submit evidence ([attestation_core_submit_evidence]) and sign the Sign & Attest declaration on the dashboard	Only with a linked profile	✓	Through their own profile
attestation_core_upload_documents	Upload documents on My Documents ([attestation_core_my_documents])	Only with a linked profile	✓	Through their own profile
attestation_core_download_own_documents	Download their own documents	Only with a linked profile	✓	Through their own profile
attestation_core_download_own_evidence	Download files attached to their own evidence	Only with a linked profile	✓	Through their own profile
attestation_core_view_own_profile	Marks the user as an active portal user. Pro uses it to grant the Pro portal capabilities below	Only with a linked profile	✓	Through their own profile
attestation_core_view_own_matrix	Reserved. Granted, but not checked by any screen in 1.0.0	Only with a linked profile	✓	Through their own profile

Pro portal capabilities

Granted to the same people as the staff portal capabilities, but only while the Pro licence is active.

Capability	What it allows	Admin	Staff	Coordinator
attestation_core_submit_plan	Save and submit their annual plan ([attestation_core_submit_plan])	Only with a linked profile	✓	Through their own profile
attestation_core_export_own_record	Download their compliance record PDF ([attestation_core_my_record])	Only with a linked profile	✓	Through their own profile

Pro coordinator marker

Capability	What it allows	Admin	Staff	Coordinator
attestation_core_department_coordinator	Marks the user as a coordinator. While it’s present, the four scoped capabilities above (manage trainers, manage documents, validate evidence, manage plans) are granted only for records in their departments	–	–	✓ (added and removed automatically from Departments)

WordPress core capabilities the plugin also checks

Capability	Used for
manage_options	Action Log. Pro Licence tab. Saving the Labels tab and evidence categories. The upgrade notice. The “(admins only)” configuration links and licence notices shown on portal pages. Users with it are never redirected to the portal at login
activate_plugins	The private-storage security notice and the Pro welcome notice

Tip: The Labels and Evidence categories settings need manage_options as well as attestation_core_manage_settings. That only matters if you’ve given settings access to a non-administrator role.

---

Assigning portal access

Link an existing WordPress user to a profile

1. Go to Attestation Core → Compliance Profiles and open the profile, or create one with Add profile.
2. Choose the person under Linked WordPress user. Any user can be linked. Users with the Trainer / Assessor role are tagged in the list.
3. Click Save Changes.

A profile with no linked user shows “No WordPress user is linked to this profile, so this staff member cannot sign in to the portal.”

Create the user after the profile

If a profile already exists, create the WordPress user (Users → Add New) with the same email address. The plugin links them automatically, whatever role you choose. This is the quickest way to give portal access after a CSV import. See Bulk import staff from CSV.

Remove portal access

Archive the profile (Archive profile on the profile, or Archive selected in the list). The data is kept. To restore access, change the status back to Active.

---

Troubleshooting

Problem	Fix
A staff member sees “Your account is signed in but no active compliance profile is linked to it.”	Link their user on the profile, or make sure the profile isn’t Archived
An administrator sees the same message on a portal page	Expected. Administrators only get portal pages when they have a profile of their own
A coordinator can’t see a person	That person isn’t in any of the coordinator’s departments. Add them under Departments → Edit → Trainers
A coordinator gets “Sorry, you are not allowed to access this page.” on Reports or Dashboard	Expected. Those screens are administrator-only
Someone isn’t in the Department Coordinators list	Their profile needs the Leadership / manager workforce category, a linked WordPress user and an Active status