Welcome!

Roles and Scopes

TL;DR; Every role grant is attached to a scope — the whole company, one department, one course, or one Knowledge Base — and a grant at a broader scope automatically covers everything narrower underneath it. It never works the other way around.

Before you start

See People for where these grants show up day to day.

Steps

  1. A role grant is always made at exactly one scope: Company, Department, Course, or Knowledge Base (Lupo's own platform staff hold a fifth, platform-wide scope above all of these). Company Administrator is a Company-scoped grant; Instructor, Student and Observer are Course-scoped; Knowledge Base Manager and Member are scoped to one Knowledge Base.

  2. Resolution walks downward only — Company → Department → Course. A Company Administrator's grant covers every department and course underneath their company automatically, without a separate grant at each level. A Course-scoped grant never reaches upward — it covers that one course and nothing above it.

  3. Knowledge Base access is its own separate branch, not part of that chain — see Knowledge Base access for the one exception: a Company Administrator reaches every Knowledge Base in their company without a grant, short of the two things that stay with the Manager role.

What this doesn't do

There's no "view as" — no way to see the app the way a lower-privilege role sees it from inside your own session. If you need to confirm what an Instructor or Student actually sees, sign in as a real test account with that role.

Common issues

"My courses disappeared." — If your only grant is Course-scoped (a typical Instructor), the full department course list isn't for you — it's gated to people who can see the whole department (Company Administrator and above), and Lupo sends you to My Courses instead. You're not missing anything; My Courses shows every course you're actually granted on.

Course roles carry zero Knowledge Base capabilities. — Being able to edit a course doesn't extend to its Knowledge Base. See Knowledge Base access for the separate grant that's actually needed.

SSO isn't something a Company Administrator can turn on. — Single sign-on is configured per tenant by Lupo's platform team, not from inside a company's own admin pages. If your organization needs it, that's a conversation with your Lupo contact, not a setting to find yourself.

Where to go next