AI School Management System
The problem
A school runs on registers, WhatsApp groups, printed circulars and whoever remembers what. Attendance lives in one book, marks in another, parent communication in a teacher’s personal phone. Nobody can answer a simple question — was this parent actually told? — without asking three people.
What we built
One platform for the whole school: attendance registers, assignments, study materials, events, announcements, fees, staff and student records, reporting, and parent communication over the WhatsApp Cloud API. Every screen reads and writes real data, and every protected action is authorised on the server — hidden UI is never the control.
The hard part
Permissions answer “may this user do this?”. Scope answers “to whose records?”. Both are enforced on every read and write, so a parent editing the student ID in the URL gets a 404 rather than another family’s child. Roles are data, not code: a school can create its own “Examination Coordinator” and grant permissions without a deploy — and can never lock itself out.
The AI, deliberately fenced in
The assistant never touches the database directly. It reads through the same scoped queries the interface uses, so it can only reason about records that person was already allowed to see, and treats the content it reads as data rather than instructions. Without an API key a deterministic engine answers the same questions straight from school records.
