SkieHow do we give each warden access only to their own block?
Invite the warden at the branch level for their block, or at group level for a floor. They then see only that part of the hostel, and page access can hide location or settings for their role. Head office keeps the full view. You can disable a warden's login the moment they leave.
Hostel staff change often, and not everyone should see everything. Skie roles follow the structure, so access is given by placing a person at a level. A branch or section head role placed on A block sees A block. A class admin style role placed on one floor sees that floor.
Scope covers both what a person sees and what they can do. A block warden can lock the groups in their block, give an extra app, check which devices are offline and handle a lost tablet. They cannot see B block, change the hostel-wide policy or touch settings locked above them.
Page access is a second control. Even inside the block, you can switch pages on or off per role. Many hostels keep location for the chief warden and one deputy, and give floor monitors lock and status only. Parents have read-only access to their own child. This is a clear fit for hostels, where location is the most sensitive page.
Invite and disable work at the level you control. When a warden resigns, disable their login the same day. Because users are separate from devices, nothing changes for students.
There is an audit log of actions, so you can see who locked a group or changed a rule. Skie's own owner and technician roles can reach data for support, and the agreement should say how.
The role-based access blog post covers the model in more depth for schools.
A practical tip: review the user list every term. Remove anyone who has left, and check that each person still needs the pages they have. Access creeps upward over time unless someone prunes it.