Role-Based Access Control from Day One
Rather than bolting on permissions later, I designed the auth system with three distinct JWT-scoped roles from the start. Each role gets a completely different dashboard and API surface, so a parent can never accidentally hit a teacher-only endpoint.


