Access Rights

Artemis separates three global authorities — USER, ADMIN, and SUPER_ADMIN — from the roles assigned within each course: Student, Teaching Assistant, Editor, and Instructor. A course role grants access only in that course; it does not make the user an administrator.

Minimum course-role checks follow the order Student, Teaching Assistant, Editor, Instructor. A higher role satisfies a lower-role check within the same course. Anonymous describes a visitor who has not signed in, rather than a global authority.

Roles Overview

Global authorities apply across Artemis:

• SUPER_ADMIN: has all permissions that an ADMIN has and additional privileges for critical security operations (see Super Admin vs Admin for details)
• ADMIN: can administer the server, manage non-admin accounts, and create courses; the additional security privileges of Super Admin remain separate
• USER: identifies a regular signed-in account; access to a particular course depends on its course roles

Course roles describe what a user can do in a particular course:

• Instructor: can manage course content and participants, including creating and deleting exercises, exams, and lectures, and monitoring scores and submissions
• Editor: can create and edit course content but cannot delete it; access to other participants' information is limited
• Teaching Assistant: can assess student submissions and view course content before its release date
• Student: can participate in the course and view its released content

ℹ️

Information:

Adding or removing a course role changes the user's access on subsequent requests without signing out and back in. Reload an already open page if its controls still show the previous access.

In the user editor, Global Roles offers Student (the USER authority), Admin, and Super Admin to a Super Admin. A regular Admin can assign only Student. The separate Course Roles panel lists memberships by course and saves changes immediately.

Global authorities and course memberships are managed separately.

In the following, the respective permissions illustrated. If a subordinated role has all permissions or a role does not have any access rights, it is not explicitly displayed.

Super Admin vs Admin

While Super Admins have all the permissions of regular Admins, they have additional privileges in security-critical areas:

Admin User Management

Only Super Admins can manage administrator accounts (both Admin and Super Admin users). This includes:

• Creating new admin or super admin users
• Updating existing admin or super admin users
• Activating/Deactivating admin or super admin users
• Deleting admin or super admin users

Regular Admins can manage accounts without an Admin or Super Admin global authority. Holding an Instructor, Editor, or Teaching Assistant role in a course does not make an account an administrator.

Passkey Approval

Super Admins have the exclusive privilege to approve passkey registrations for administrators. This minimizes the attack surface for critical security operations by limiting passkey approval to a very small number of trusted users.

For detailed information about passkey authentication, configuration, and the approval process, see the Passkey Authentication section in the Security Configuration documentation.

ℹ️

Information:

Super Admin privileges ensure that only the most trusted users can manage administrator accounts and approve passkeys for administrators. This minimizes the attack surface for critical security operations.

Terminology

ℹ️

Information:

Import Exercise requires at least Editor role in both the source and target course.

ℹ️

Information:

Course membership terminology:

• "if in course": User must be assigned to the course as staff (member of the course's TA, Editor, or Instructor group)
• "if enrolled": User must be enrolled as a student (member of the course's Student group)
• "if visible": User can view the resource according to its release date or visibility settings (typically based on releaseDate). See Lectures > Visibility Rules for detailed definitions.

Both "if in course" and "if enrolled" require the user to be associated with the specific course - platform-wide roles alone are not sufficient.

Navigation

Feature	Super Admin	Admin	Instructor	Editor	Teaching Assistant	Student
Course Overview	✔	✔	✔	✔	✔	✔
Course Management	✔	✔	✔	✔	✔
Edit Course	✔	✔	✔
Create new course	✔	✔
Delete Course	✔	✔
Server Administration	✔	✔
Manage Non-Admin Users	✔	✔
Manage Admin Users	✔
Approve Passkeys	✔

Course

Feature	Instructor	Editor	Teaching Assistant
Exercises	✔	✔	✔
Exams	✔	✔	✔
Assessment Dashboard	✔	✔	✔
Statistics	✔	✔	✔
Lectures	✔	✔	✔
Learning Goals	✔
Instructor Course Dashboard	✔

Exercises

Common Prerequisites

The following prerequisites apply to all exercise types unless otherwise noted:

• Course Enrollment: All exercise access requires enrollment in the course (except for Admins)
• Admin Override: Admins can access all exercises regardless of course membership
• Exam vs Course: Exam exercises require Editor role for viewing details; course exercises only require TA role

Common Visibility Rules

The following visibility rules apply to all exercise types:

Exercise Release:

• Students can only view and participate in exercises after the releaseDate has passed
• Teaching Assistants and above can view exercises before release

Submission Due Date:

• All users can only submit before the exercise dueDate
• Submissions after due date are rejected (except for exam exercises which have separate handling)

Own Submission/Participation:

• Students can only view their own participations and submissions
• Teaching Assistants and above can view all participations and submissions

Assessment Results:

• Students can view their assessment results only after the assessment is finalized AND the assessment due date has passed
• Assessor information is hidden from students until assessment is finalized

Example Solution:

• Students can view the example solution only after it has been published (isExampleSolutionPublished())
• Teaching Assistants and above can view example solutions at any time

ℹ️

Information:

Exam exercises have separate submission handling and do not follow the standard due date rejection rules.

General Functionality

The following permissions apply to all exercise types. Exercise-type-specific sections below list only additional features or where permissions differ.

Feature	Instructor	Editor	Teaching Assistant	Student
View Exercise (course)	✔ (if in course)	✔ (if in course)	✔ (if in course)	✔ (if enrolled + released)
View Exercise (exam)	✔ (if in course)	✔ (if in course)
Exercise Detail View	✔	✔	✔
Create Exercise	✔	✔
Edit Exercise	✔	✔
Delete Exercise	✔
Import Exercise	✔ (both courses)	✔ (both courses)
Search Exercises	✔	✔
Scores	✔	✔	✔
Participation	✔	✔	✔
Start + Submit Exercise	✔	✔	✔	✔
Create / Update Example Submissions	✔	✔
View / Assess Example Submissions	✔	✔	✔
Check Plagiarism	✔	✔
Export All Submissions	✔
Add External Submission	✔

ℹ️

Information:

See the Terminology section for definitions of "if in course" and "if enrolled" conditions.

⚠️

Warning:

Exam exercises require Editor role for viewing details, while course exercises only require Teaching Assistant role.

For course programming exercises, tutors and editors can see student names and team identities on the participations page to help students with questions. The Code button opens a read-only repository view and provides clone URLs. Tutors can clone and pull student repositories, but cannot push or reset them.

When manual or semi-automatic assessment is enabled, this support access ends at the exercise due date: non-instructors see anonymous participation IDs, and student names, identity search and sorting, and direct repository links are hidden. Tutors can no longer read or clone another student's live repository, including with previously issued tokens or SSH keys. They can still view submitted code and download anonymized submissions through the Assessment Dashboard. The restriction uses the exercise due date for the whole list, including participations with individual extensions and practice participations, so that those cannot expose identities during assessment.

For automatically assessed course programming exercises, support access remains available after the due date. A manually assessed course programming exercise without a due date also keeps support access; anonymity starts if a due date is subsequently set and reached. The participations page explains the current access and any upcoming restriction.

Course quizzes are always assessed automatically, so there is no tutor assessment to keep anonymous. Tutors and editors see student names next to the quiz scores on the participations page.

Other exercise types and exam exercises, including exam quizzes, retain anonymous participation views for non-instructors. The participations list of an exam exercise is only available to instructors, and the direct participation lookups of other staff stay anonymous. Instructors retain named views, and participation owners retain access to their own details. Exports selected by student login or team name and identity exports continue to require instructor access.

Shared Submission and Assessment Features

The following features are shared across File Upload, Modeling, and Text exercises. Programming and Quiz exercises have different submission and assessment models — see their dedicated sections.

ℹ️

Information:

Double-blind assessment is supported: TAs cannot see student/team information during assessment. Students cannot see who assessed their submission.

Feature	Instructor	Editor	Teaching Assistant	Student
Re-evaluate Exercise	✔	✔
View Course Exercises	✔ (if in course)	✔ (if in course)	✔ (if in course)
Submit Exercise	✔ (before due date)	✔ (before due date)	✔ (before due date)	✔ (before due date)
View Own Submission	✔	✔	✔	✔ (own only)
View Submission Editor Data	✔	✔	✔	✔ (own only)
Get Submission (for assessment)	✔	✔	✔
Get Unassessed Submission	✔	✔	✔
List All Submissions	✔	✔	✔
Save Assessment	✔	✔	✔
Cancel Assessment	✔	✔	✔
Update After Complaint	✔	✔	✔
View Assessment Result	✔	✔	✔	✔ (own, after graded)
Delete Assessment	✔
Export Submissions (limited)	✔	✔	✔

Programming Exercises

In addition to the General Functionality above, Programming Exercises have these specific features:

Feature	Instructor	Editor	Teaching Assistant	Student
Clone Repository	✔	✔	✔
Download Repo	✔	✔	✔
Export Instructor Repository	✔	✔	✔
Export Student Repository	✔ (all)	✔ (all)	✔ (all)	✔ (own only)
Export Solution (if published)	✔	✔	✔	✔
Edit in Editor	✔	✔
Manage Hints	✔	✔
Update Structure Test Oracle	✔	✔
View Template/Solution Repos	✔	✔
Trigger Template/Solution Build	✔	✔
Edit Test Cases	✔	✔
View Test Cases	✔	✔	✔
View Grading Statistics	✔	✔
Manage SCA Categories	✔	✔
Import SCA Configuration	✔ (both courses)	✔ (both courses)
Manage Submission Policies	✔
View Submission Policy	✔	✔	✔	✔
Re-evaluate All Results	✔
Trigger All Builds	✔
(Un-)lock All Repositories	✔
Download All Repos	✔
Cleanup	✔
Build Plan Access	R + W	R + W	R
Participate in Exercise	✔	✔	✔	✔ (if released)
Trigger Own Build	✔	✔	✔	✔
Get Exercise Tasks	✔	✔	✔

ℹ️

Information:

Import SCA Configuration requires at least Editor role in both the source and target course.

Repository Access

Action Types:

• READ (fetch, pull)
• WRITE (push)
• RESET (reset to origin head)

Access to all repositories of a course:

Admin / Instructor / Editor	Teaching Assistant	Student
READ, WRITE, RESET	READ	restricted

For another student's assignment repository, tutor READ access is subject to the support window described above: it ends at the exercise due date when manual or semi-automatic assessment is enabled. Tutors cannot directly access student assignment repositories of exam exercises. Read access to template, solution, test and auxiliary repositories is unaffected; anonymous assessment snapshots remain available.

Access on own repositories (graded participation):

Context	Instructor / Editor	Teaching Assistant	Student
Before start	READ, WRITE, RESET	READ, WRITE, RESET	restricted
After start but before due date and not locked	READ, WRITE, RESET	READ, WRITE, RESET	READ, WRITE, RESET
After due date	READ, WRITE, RESET	READ	READ
Locked	READ, WRITE, RESET	READ	READ

ℹ️

Information:

Practice repositories also allow WRITE and RESET access after the due date.

Additional Visibility Rules for Programming Exercises

Test Case Visibility:

• Test case visibility is controlled per test case via the Visibility enum: ALWAYS, AFTER_DUE_DATE, NEVER
• Exam exercises default to AFTER_DUE_DATE; course exercises default to ALWAYS
• The releaseTestsWithExampleSolution flag controls when tests are revealed

Solution Repository:

• Students can export the solution repository only after the example solution has been published
• Before publication, Teaching Assistant role is required

Quiz Exercises

In addition to the General Functionality above, Quiz Exercises have these specific features:

ℹ️

Information:

Quiz exercises use a different submission and assessment model from other exercise types. The Shared Submission and Assessment Features do not apply to quizzes.

Feature	Instructor	Editor	Teaching Assistant	Student
Set Visible	✔	✔
Start Now	✔	✔
End Now	✔
Preview	✔	✔	✔
Sample Solution	✔	✔	✔	✔ (after quiz ends)
View Statistics	✔	✔	✔
Recalculate Statistics	✔	✔	✔
Evaluate Quiz	✔
Re-evaluate Quiz	✔
Delete Result	✔
Submit (Live Mode)	✔	✔	✔	✔
Submit (Practice Mode)	✔ (after quiz ends)	✔ (after quiz ends)	✔ (after quiz ends)	✔ (after quiz ends)
Submit (Exam Mode)	✔	✔	✔	✔
Start Participation	✔ (if released)	✔ (if released)	✔ (if released)	✔ (if released)
Join Batch	✔ (if started)	✔ (if started)	✔ (if started)	✔ (if started)
Create Batch	✔	✔	✔
Start Batch (own)	✔	✔	✔
Start Batch (others')	✔
Training Questions	✔	✔	✔	✔
Submit Training Answer	✔	✔	✔	✔
View Training Leaderboard	✔	✔	✔	✔
Update Leaderboard Settings	✔	✔	✔	✔

⚠️

Warning:

End Now requires Instructor role (higher than Start Now which only requires Editor).

Batch Mode

Quiz exercises support three modes: SYNCHRONIZED, BATCHED, and INDIVIDUAL.

Operation	Mode	Teaching Assistant	Student
Join Batch	BATCHED/IND.	✔ (if quiz started)	✔ (if quiz started)
Create Batch	BATCHED/IND.	✔
Start Batch	BATCHED/IND.	✔ (own batches) / INSTRUCTOR (others')

ℹ️

Information:

Batch operations are not allowed for exam quiz exercises - they are only available for course quizzes.

Additional Visibility Rules for Quizzes

Quiz Started:

• All users can join batches only after the quiz has started (and not ended)
• Batch joining is not available for exam quiz exercises

Practice Mode:

• All users can submit in practice mode only after the quiz has ended
• For exam exercises, practice mode is only available for test exams

File Upload Exercises

File Upload Exercises follow the General Functionality and Shared Submission and Assessment Features above with no additional exercise-type-specific features.

Modeling Exercises

In addition to the General Functionality and Shared Submission and Assessment Features above, Modeling Exercises have these specific features:

Apollon Diagram Templates

Apollon diagram templates are course-level reusable diagram structures that instructors and course staff can create as reference materials for exercises. The permissions below apply to managing these templates, not to students creating their own models during exercise submissions.

Feature	Instructor	Editor	Teaching Assistant	Student
Create Template Diagram	✔	✔	✔
Edit Template Diagram	✔	✔	✔
View Diagrams (Course)	✔	✔	✔
Delete Template Diagram	✔	✔
View Diagram Title	✔	✔	✔	✔
Convert Model to PDF	✔	✔	✔	✔

ℹ️

Information:

Note: Students can create and submit their own Apollon models when participating in a modeling exercise. This table only covers the creation and management of course-level template diagrams for instructional purposes.

Text Exercises

In addition to the General Functionality and Shared Submission and Assessment Features above, Text Exercises have these specific features:

Feature	Instructor	Editor	Teaching Assistant	Student
Submit Assessment	✔	✔	✔
Save Example Assessment	✔	✔
Delete Example Assessment	✔	✔	✔
View Plagiarism Result	✔	✔
Add Assessment Event	✔	✔	✔
View Tutors Involved Analytics	✔
View Assessment Events (Admin)	Admin only

ℹ️

Information:

Text exercises also support Athena AI feedback suggestions (if enabled).

Lectures

Feature	Instructor	Editor	Teaching Assistant	Student
View Lecture	✔ (if in course)	✔ (if in course)	✔ (if in course)	✔ (if enrolled)
View Lecture Details	✔ (if in course)	✔ (if in course)	✔ (if in course)	✔ (if enrolled)
Create Lecture	✔	✔
Edit Lecture	✔	✔
Delete Lecture	✔
Import Lecture	✔ (both courses)	✔ (both courses)
Search Lectures	✔	✔
View Lecture Unit	✔	✔	✔	✔ (if visible)
Add Lecture Unit	✔	✔
Edit Lecture Unit	✔	✔
Delete Lecture Unit	✔
Complete Lecture Unit	✔	✔	✔	✔ (if visible)
View Lecture Unit Processing	✔	✔
Retry Lecture Unit Processing	✔	✔
View Attachment	✔	✔	✔	✔ (if visible)
View all Attachments for Lecture	✔	✔	✔
Add Attachment (in unit)	✔	✔
Edit Attachment	✔	✔
Delete Attachment	✔

ℹ️

Information:

Import Lecture requires at least Editor role in both the source and target course.

ℹ️

Information:

See the Terminology section for definitions of "if in course", "if enrolled", and "if visible" conditions.

Summary

Role	Capabilities
Student	View lectures/units in enrolled courses (after release date)
TA	Same as Student + see all units regardless of release date
Editor	Same as TA + create/update lectures, units, and attachments
Instructor	Same as Editor + delete lectures, units, and attachments
Admin	Full access to all lectures

Prerequisites

• Course Enrollment: All lecture access requires enrollment in the course (except for Admins)
• Admin Override: Admins can access all lectures regardless of course membership

Visibility Rules

Visibility conditions marked as "(if visible)" or "(if enrolled)" in the table above are defined as follows:

Lecture Units and Attachments:

• Visible to students if releaseDate is null OR releaseDate is in the past
• Teaching Assistants and above can see all units/attachments regardless of release date

Search Lectures:

• Non-admin users only see lectures from courses where they have at least Editor role

⚠️

Warning:

The visibleDate field on the Lecture entity is deprecated and will be removed. All visibility control is managed at the lecture unit and attachment level via their releaseDate fields.

Exam

Feature	Instructor	Editor	Teaching Assistant
Assessment Dashboard	✔	✔	✔
View Exercise Groups	✔	✔
Create Exercise Group	✔	✔
Edit Exercise Group	✔	✔
Import Exercise Group	✔	✔
Delete Exercise Group	✔
Create Exam	✔
Edit Exam	✔
Import Exam	✔
Archive Exam	✔
Delete Exam	✔
Exam Checklist	✔
Scores	✔
Test Run	✔
Student Exams	✔
Students	✔