Overview
School staff who need to work with Shield alerts — counselors, administrators, and read-only staff members — each get a dedicated role with appropriate permissions. This article explains how to add a staff member, which role to assign, and what each role can and cannot do.
The Four School-Side Roles
Shield has four roles available for people who work at a school (as opposed to MSP staff, who manage Shield from the hub):
School Admin
The most capable school-side role. A school admin can:
- View, acknowledge, resolve, and mark false-positive on all alerts
- Manage parent accounts: add parents, verify consent, and remove parent records
- Comment on alert threads (internal and non-internal)
- Moderate comments left by other staff (except THEO replies)
- View student timelines and risk scores
- Adjust school settings: name, logo, notification routing, Sentinel configuration
- View DNS policy (read) and, if the MSP grants it, adjust DNS policy
- Run all reports including CIPA compliance reports
Assign this role to your school's designated Shield administrator — typically a dean, assistant principal, or someone in an IT/administrative position who owns the program.
Counselor
The primary working role for day-to-day alert response. A counselor can:
- View, acknowledge, resolve, and mark false-positive on alerts (with the appropriate permission flags)
- Add and manage parent accounts, including verifying consent
- Comment on alert threads (internal and non-internal)
- View student timelines and risk scores
- Run reports
A counselor cannot change DNS policy or school settings. Assign this role to licensed counselors and other staff who are directly involved in student-safety response.
Staff
A read-oriented role for staff who need visibility into alerts without being responsible for resolving them. A staff member can:
- View alerts and student timelines
- Post comments on alert threads (non-internal only)
- View reports
A staff member cannot acknowledge, resolve, or mark false-positive on alerts. They cannot add or manage parent accounts or change any settings. Assign this role to teachers, social workers, or other staff who benefit from awareness but are not the primary responders.
Parent
The parent role is used exclusively for parents and guardians accessing the parent portal. Parents see only their own linked students' alert summaries and comment threads. They never see case files, student hashes, internal notes, or alerts for other students.
Parent accounts are managed separately through the parent invitation flow, not the staff invitation flow described in this article.
How to Invite a Counselor or Staff Member
Inviting a school staff member is managed through the Hub's user management interface, typically by an MSP administrator or a school administrator.
- Open the school's user management section in the Hub or portal.
- Click Invite User.
- Enter the staff member's email address and name.
- Select the appropriate role: school admin, counselor, or staff.
- The invitation is scoped to this school's client ID — the staff member will only have access to this school's data, not other schools.
- Send the invite. The staff member receives a magic-link email. Clicking it completes their account setup and takes them to the school portal.
Permission Flags
Within the counselor and staff roles, finer-grained permissions are controlled by flags. The most relevant ones:
- shield.view_alerts — Required to see alerts. Counselors and staff have this by default.
- shield.resolve_alerts — Required to acknowledge and resolve alerts. Counselors have this by default; staff do not.
- shield.mark_false_positive — Required to mark an alert as a false positive. Counselors have this by default; staff do not.
- shield.manage_dns_settings — Allows DNS policy changes. Included in the school admin template and can be added to counselor accounts if appropriate.
If a staff member reports they cannot perform an expected action, the missing permission flag is the most common cause. Contact the MSP to adjust the flags on a specific user's role.
Frequently Asked Questions
Can a counselor from one school see another school's alerts?
No. School-side roles are scoped to the specific school (client ID) they were invited to. A counselor at Lincoln Middle School cannot see alerts from Westside Elementary even if both are managed by the same MSP.
What if a staff member changes roles — for example, a staff member who becomes a counselor?
The MSP or school admin needs to update the user's role assignment in Hub user management to grant the new permissions.
Can I have more than one school admin?
Yes. Multiple users can hold the school admin role for the same school. There is no limit.
Does inviting a staff member give them access to the MSP hub?
No. School-side roles only grant access to the school's section of the portal. MSP hub access requires a different user type and is managed separately.
How does a staff member log in?
The same way parents do — with a magic-link email. There is no separate password system. When they need to log back in, they go to the portal URL and request a fresh sign-in link.