User Roles & Permissions

Dantian Course Cadence does not add any WordPress roles or capabilities of its own. It works out what each person may do from two things you already manage:

1. Their WordPress role — only people who can manage the site (the manage_options capability, which the standard Administrator role has) can open any Course Cadence admin screen.
2. Their place in each course — whether your LMS (Tutor LMS or LifterLMS), or the plugin’s own Classes screen in Native Classes mode, lists them as a trainer (instructor) or an enrolled student of that course.

Because trainer and student status come from course membership rather than a WordPress role, a trainer is usually an ordinary Subscriber-level account that has been made an instructor of a course. Nobody can make themselves a trainer or a student — those assignments are made by an administrator in the LMS or on the Classes screen.

The four kinds of user

User	How the plugin recognises them
Administrator	Any logged-in user with the manage_options capability (normally the WordPress Administrator role). Course administrators, college administrators and site administrators are all WordPress Administrators to the plugin — the difference between them is organisational, not technical.
Trainer	A logged-in user who is an instructor of a specific course, as defined by the active LMS (see How trainers are identified). Trainer access is per course: a trainer of Course A has no trainer access to Course B.
Student	A logged-in user with an active enrolment in a specific course (see How students are identified). Student access is also per course.
Logged-out visitor	Anyone not logged in. They see a log-in prompt on every Course Cadence page and nothing else.

One person can be more than one of these — for example, an Administrator who is also a Tutor LMS instructor.

Who can do what

Admin screens

All Course Cadence admin screens require manage_options. Users without it do not see the Course Cadence menu at all.

Admin screen (Course Cadence → …)	Administrator	Trainer	Student	Logged-out visitor
Overview (tabs: All courses · This week)	Full access	No access	No access	No access
Classes (Native Classes mode only)	Create and edit classes, add/remove students and trainers	No access	No access	No access
Timelines & Prompts	Create, edit, delete, clone and move timelines and prompts; link lessons; version history and rollback	No access	No access	No access
Email Delivery (tabs: Send & Status · Analytics · Test Emails)	Delivery status, “Trigger weekly dispatch now”, manual catch-ups, analytics, test emails	No access	No access	No access
Pending Suggestions	Approve or reject trainer edit suggestions	No access	No access	No access
Settings (tabs: Schedule · Emails · Workflow · System, including the audit log)	Full access	No access	No access	No access

The Classes screen appears only when the plugin is in Native Classes mode (no Tutor LMS or LifterLMS active) and the Dantian Training Hub plugin is not active. See LMS integration and native classes.

There is no way to give a non-administrator partial access to the admin screens (for example, Email Delivery only). If someone needs any admin screen, they need the manage_options capability.

Front-end pages (shortcodes)

Page (shortcode)	Administrator	Trainer	Enrolled student	Logged-out visitor
Student guidance [dcc_student]	Without a course set: their own enrolled courses only. With a course set (course_id attribute or an email link): any course, enrolled or not.	Treated like any other user: sees only courses they are enrolled in as a student. Otherwise “You are not enrolled in this course.”	Guidance for their enrolled courses: current week, past weeks, progress, search. Trainer-only prompts are hidden unless the page uses show_trainer_notes="true".	“Please log in to view your guidance.” with a Log in to view your guidance button
Trainer guidance [dcc_trainer_edit]	Course list shows only courses they instruct (or “You are not assigned as a trainer to any courses.”). Opening a specific course works for any course, and they can suggest edits there.	Their own courses only: student and trainer guidance for every scheduled week, and Suggest Edit on current and future weeks not yet sent	“Only assigned trainers can access this interface.” (or “You are not assigned as a trainer to any courses.” on the course list)	“Please log in to access the trainer interface.” with a Log in button
Email preferences [dcc_email_prefs]	Only courses they are enrolled in as a student; otherwise “You are not enrolled in any courses.”	Same as administrator — trainers who aren’t enrolled as students see “You are not enrolled in any courses.”	A toggle for each enrolled course	“Please log in to manage your email preferences.” with a Log in button

The log-in buttons return the person to the same page after they log in, so email links work for logged-out readers.

Actions and emails

Action	Administrator	Trainer	Enrolled student
Create, edit or delete timelines and prompts in the admin	Yes	No (no admin access)	No
Suggest an edit to a prompt	Yes (any course)	Yes — their own courses, current and future weeks that haven’t been sent	No
Approve or reject suggestions	Yes	No	No
Search guidance (search box on the student page)	Only finds results in courses they’re enrolled in	Only in courses they’re enrolled in as a student	Yes — student guidance in their enrolled courses, up to the current week
Opt out of a course’s emails	Only for courses they’re enrolled in	Only for courses they’re enrolled in as a student	Yes, per course
Receive weekly student guidance emails	Only if enrolled as a student and not an instructor (see below)	Never for a course they instruct	Yes, unless opted out of that course
Receive weekly trainer guidance emails	Only for courses they instruct	Yes, for each course they instruct	No
Receive catch-up emails	Only as an enrolled student (not an instructor)	Never	Yes, unless opted out (Fixed period timelines only)
Receive the admin digest, preview and late-dispatch warning	Whoever is set as the Digest Recipient Email (default: the site admin email)	No	No
Receive edit-suggestion notifications	The site’s Administration Email Address, if recipients include Admin	The suggesting trainer, if recipients include Trainer	No

Instructors never receive student emails. When building the student list for a course, the plugin removes that course’s instructors and anyone whose account is an instructor account in your LMS — even if they are also enrolled as a student. This stops trainers being sent student guidance (and catch-ups) for the courses they teach. In practice this means a staff member who is an instructor anywhere on the site will not receive student-audience emails; give them a separate student account if they also need to study a course.

How trainers are identified

Trainer access for a course depends on the active LMS:

LMS mode	Who counts as a trainer of a course	Who counts as an “instructor account” (excluded from all student emails)
Tutor LMS	The course author, any additional instructors added to the course in Tutor LMS, and users Tutor LMS records as instructors of that course	Users with Tutor LMS’s instructor role, or flagged as an instructor by Tutor LMS
LifterLMS	The instructors listed on the course in LifterLMS (falling back to the course author)	Users with LifterLMS’s Instructor, Instructor’s Assistant or LMS Manager role
Native Classes	Members added to the class with the role Trainer on Course Cadence → Classes	Anyone who is a Trainer in any active class

To give a new trainer access, assign them as an instructor of the course in your LMS (or add them to the class as a Trainer). Access normally applies straight away. On Tutor LMS sites that use a persistent object cache (such as Redis or Memcached), the plugin may keep using the previous instructor list for up to two hours. When a trainer leaves, remove them as instructor — their past suggestions stay in the history and audit log.

How students are identified

LMS mode	Enrolled student
Tutor LMS	A user with an active (completed) Tutor LMS enrolment in the course. Cancelled enrolments do not count.
LifterLMS	A user LifterLMS reports as enrolled in the course
Native Classes	A member added to the class with the role Student

When someone stops being enrolled, they stop receiving that course’s emails and lose access to its guidance on the student page.

Things trainers cannot do

On every screen the plugin provides, trainers can only view guidance and suggest changes:

• They cannot open any Course Cadence admin screen.
• They cannot create or delete prompts or timelines from the trainer page.
• They cannot suggest edits for past weeks (“Past weeks can’t be edited.”) or weeks already sent (“This week has already been sent and can’t be edited.”).
• They cannot see or act on courses they are not assigned to.
• With Require Admin Approval on (the default), their suggestions change nothing until an administrator approves them. With Auto-Approve, suggestions apply immediately and are still logged. See Trainer edit workflow.

The trainer page’s week-by-week / multi-week view switch works for every trainer. The plugin also remembers the chosen view for next time, but only for accounts that can edit posts (Contributor role or higher); for Subscriber-level trainers the page opens in week-by-week view each visit.

A note for site administrators: designating instructors

Being made an instructor of a course is a real grant of trust. On the screens the plugin provides, trainers can only suggest edits. However, the plugin’s underlying web API (the interface its admin screens use to save data) authorises a course’s designated instructor to create, edit and delete that one course’s timelines and prompts — by design, so that delegated trainers keep working without needing an elevated WordPress role. This permission is limited to the instructor’s own courses and never extends to other courses or to settings.

In practice: only make trusted staff instructors, and review the Settings → System → Audit Log if content changes unexpectedly — every change is recorded with the user who made it.

Security measures that protect these permissions

• Every admin screen and admin action checks for manage_options, and the audit log checks it again before showing who did what.
• Every trainer action checks that the person is an instructor of that specific course; every student action checks enrolment in that specific course.
• Forms and background requests carry WordPress security tokens (nonces), so they can’t be triggered from another site.
• Attachment links on prompts are limited to your own site and an allow-listed set of domains (Settings → Emails → Attachments).
• The plugin makes no calls to outside services; email is sent through your site’s normal WordPress mail setup.

Worked example: an RTO with Tutor LMS

Northside Allied Health Academy runs Tutor LMS.

• Priya (WordPress Administrator) manages timelines, approves suggestions and receives the Friday preview email.
• Marcus is a Subscriber who is listed in Tutor LMS as an additional instructor on “Massage Therapy Practice — Term 4”. On the trainer page he sees that one course, every week’s student and trainer guidance, and a Suggest Edit button on this week (if not yet sent) and future weeks. He receives the weekly trainer email for that course but never the student email, even though Tutor LMS also enrolled him so he could preview lessons.
• Aiyana is enrolled in that course and in “Anatomy Foundations”. She gets one consolidated Monday email covering both, can open any past week on the guidance page, and can opt out of Anatomy emails on the preferences page while keeping Massage Therapy emails.
• A logged-out visitor who clicks “View this guidance online” in a forwarded email sees only “Please log in to view your guidance.” — no course content.

Related

• Settings reference
• Trainer edit workflow
• Shortcode reference
• Email preferences
• Role guides: Administrator, College administrator, Site administrator, Trainer, Student