Role-based Access Control
Giving each user permissions according to their role, and limiting the data they can see — for example teachers to their own sections.
Roles group permissions (view, create, approve…) for each feature. Combined with data scope, they ensure people see only what their job needs — essential for protecting children's data.