A teacher sees the learners they teach, and nobody else. That sentence hides three separate conditions, all of which have to hold at once — and the reason it is three rather than one is a real hole that was found and closed.
The rule
- A teaching role, read from the account — Not from the session. A session is minted at login and outlives a role change, so an account whose role was removed would keep its roster until it next signed out. The role is looked up on every request, which costs one query and is always current.
- An active enrolment in a circle the viewer teaches — A teacher sees a learner enrolled in a circle they own. An institution’s admin sees a learner enrolled in any circle belonging to their institution. Nothing wider than that exists.
- A circle type that has a cohort Lab at all — Community circles are open-join, so their member list is a list of strangers rather than a class. The type filter is applied in the query rather than afterwards, so a community circle never reaches the code that would show a roster.
Why it is three conditions and not one
It used to be one: did the viewer own a circle this learner was in? That is a reasonable-sounding question with a hole in it.
Any signed-in account could create a public, open-join circle, which made them its owner. Whoever wandered in became their "learner", and the whole teaching surface opened over people who had pressed nothing but join — mastery, error profile, thirty days of study times.
The principle that came out of it is worth stating on its own: ownership is self-granted; a role is not. So the gate is the role, and the circle type, and the enrolment.
A parent is a different question
"Do you teach them" and "are they your child" are separate questions, deliberately not folded into one. The surfaces a teacher reaches show a cut that is wider than a guardian should have, so widening the teaching check to admit parents would hand every parent the teacher’s page.
A guardian’s entitlement comes from the family relationship rather than from a roster, and the answer it returns carries no circles at all — listing the child’s circles would tell a parent which rooms their child is in, to a caller who was never in them.
Nobody reaches their own data through this door
A learner’s own evidence comes from their own profile, which needs no access check and returns more than a teacher view does. Routing a learner through the teacher path instead would quietly widen what "a teacher view" is allowed to contain, which is the kind of change nobody notices until it is everywhere.
What a teaching view never contains
- Cognitive-probe results — Never, at any granularity, to a teacher, a school or a parent. Enforced by absence: the roster and cohort code do not read that table, so there is no setting to misconfigure.
- Anything a learner typed — The Lab is built from outcomes — right, wrong, how long, how confident. No endpoint behind it returns free text to any viewer.
- A rank, a league table or a sortable position — Not withheld from the display — not computed. The institution payload has no rank field by design, so there is nothing to sort by and nothing to accidentally expose. Where movement is reported it is a learner against their own earlier window.
- Group figures for a very small group — Below five learners, group statistics are withheld, because an average plus one known score identifies the rest. Individual rows and counts are still shown; it is the comparison that waits.
- Anybody outside the viewer’s own circles — There is no directory, no search across learners and no institution-wide list that is not scoped to that institution’s circles.
The learner sees the same thing
The teaching view is assembled from the learner’s own panels, so there is nothing on a teacher’s or an administrator’s screen that the learner cannot see about themselves. The boundaries are published to learners in the same words they are published to schools.
That is the sentence worth being able to say to a parent, and it is only sayable because the two views are the same code rather than two implementations that agree today.
Common questions
An institution admin sees learners actively enrolled in circles belonging to that institution. That is usually the same set, but it is reached through the circles rather than through a school-wide list, so a student nobody enrolled is not visible to anybody.