# EDU-012 — Classes and education relationships

- **Status:** blocked
- **Type:** implementation program
- **Phase:** 4
- **Blockers:** EDU-004, education relationship model decision, Member relationship contract, System data-scope policy

## Tenant-admin outcome

Tenant administrators manage classes, student education relationships, invitations, and supervision within explicit tenant and row-level scopes while Member/System remain the owners of generic users and roles.

## Scope

- Education class entity and membership relationships.
- Student/teacher/class domain roles without duplicating System RBAC.
- Invitations and duplicate-safe acceptance.
- Education profile extensions.
- Supervision relationships and data scopes if retained.
- Audit and operation logging.

## Acceptance criteria

- [ ] Generic account, password, token, tenant, and role tables are not duplicated.
- [ ] Student/teacher/class permission matrix is documented and tested.
- [ ] Cross-class and cross-tenant access is denied.
- [ ] Invitation acceptance is idempotent and auditable.
- [ ] Platform-admin tenant-ignore operations are explicit and permission guarded.
- [ ] Database changes use `flyway-postgresql`.

## Risk and rollback

- **Risk:** High authorization and relationship-integrity risk.
- **Rollback:** Disable management endpoints and correct relationships through audited forward operations.