Chamilo’s role-based permission system is one of its most powerful features and one of the most misunderstood. Understanding which role to assign to which person, can save administrators hours of troubleshooting and give your organisation the right level of security and delegation.

This article walks through each default role in Chamilo 2.0, it is also possible to define custom roles, but that is beyond the scope of this article. We explain what each role can and cannot do, and how to apply the principle of least privilege effectively.

1. User roles overview

In Chamilo 2.0, a user can be assigned one or more roles, this multi-role capability is one of the major advances in version 2.0’s permission management. There are six default roles provided out of the box.

These roles do not form a single linear hierarchy: some sit on the pedagogical branch (Learner → Teacher), others on the administrative branch (HRM → Sessions Administrator → Portal Admin). It is more accurate to think of them as two distinct branches.

Pedagogical branch

Administrative branch

2. Learner & teacher, the core pair

Learners are assigned the default role given to new users. A Learner can enrol in courses that have open registration, access all content made available to them, submit assignments, take exercises, and view their own grades and certificates. They cannot modify any course content or see other learners’ data (unless the teacher configures otherwise).

Teachers (also called Trainers) can create new courses, build all types of content, design exercises and assignments, configure the gradebook, manage enrolments, and view course-level reports for all learners. Within a course, a teacher can also act as a Course Assistant, a sub-role with limited permissions, typically used for tutors who help moderate forums and manage content without needing full teacher access.

3. Session tutor & course tutor

Chamilo’s session system (see article #5 in this series) introduces two roles that operate at the session level rather than the platform level:

A Session Tutor oversees all courses within a given session. They can view tracking data across all courses in that session, helping them monitor overall learner progress without needing full administrator rights.

A Course Tutor is assigned to a specific course within a specific session. They can manage that course’s content, track the learners enrolled, and provide day-to-day teaching. Outside that specific session, their permissions are limited.

4. HRM, sessions administrator and admin roles

The Human Resources Manager (HRM) role is designed for supervisors and L&D managers who need to monitor training progress without having the ability to modify courses or platform settings. An HRM can only see tracking and reporting data for users explicitly assigned to them by an administrator. This is ideal for line managers who need monthly training reports for their team.

The Sessions Administrator can create and manage sessions, enrol users, and assign tutors without accessing global platform settings. This is the right role for staff who need to organise training sessions without having access to the full system configuration. They have more permissions than an HRM, but fewer than a Portal Administrator.

The Portal Administrator has full access to all platform administration features: creating and managing users, courses, sessions, plugins, platform settings, authentication, branding, and maintenance tools. In a standard single-URL Chamilo installation, this is the highest role.

The Global Administrator has the same capabilities as a Portal Administrator but their access spans all access URLs in a multi-URL Chamilo setup, useful for organisations running multiple branded portals from a single Chamilo installation.

5. Practical tips for role assignment

• Always apply the principle of least privilege: assign users the minimum role they need to perform their tasks. A line manager who only needs to see reports should be an HRM, not an administrator.
• Use Sessions Administrators for delegated management: if you have staff who need to organise sessions and enrol learners but should not access global platform settings, the Sessions Administrator role is the right choice.
• Bulk-import users with a main role via CSV: Chamilo allows you to import user lists with a main role pre-assigned from a CSV file — recommended for large-scale provisioning. Note that CSV import currently supports assigning a single main role per user.
• Combine with SCIM for zero-touch provisioning: when SCIM is configured, main role assignment can be driven directly from your identity provider based on directory groups, eliminating manual role management entirely.
• Roles can be combined in Chamilo 2.0: a single user can hold multiple roles depending on context. This is a major advance over previous versions, use it thoughtfully to avoid configurations that are difficult to audit.