Status: draft for BA and security review (2026-10-30). Derived from the use cases (12-use-cases.md). Role codes are defined in 13-role-matrix.md. Cells marked [inferred] are our reading and need confirmation. Numeric values (limits, retention periods) are configured by the university and are not set here.
1. Data classification
Level
Name
Examples
Baseline controls
L1
Public
Announcements, admission criteria and rubrics, curriculum, ITA/OIT data, degree-verification result (minimal fields)
Published deliberately; PII check before publishing (W-36)
Student and applicant records, grades, attendance, finance and bank accounts, guardian relations, discipline, scholarships and กยศ., athlete performance and selection
Role + scope + relationship (ABAC); audit of changes
L4
Restricted (sensitive)
Health (hlt_vault), mental health, disability evidence, safeguarding cases, court orders and custody, whistleblower identity, national ID numbers
Need-to-know only; every read audited; break-glass with 2 approvers; never in notifications or bulk exports without DPO
PDPA §26 sensitive data (health, disability, criminal records) is always L4.
2. Access by data domain and role
Legend: C create/submit · R read · U update/process · A approve/sign · — no access. Scope in brackets: own, rel (guardian relation), sec (sections taught), adv (advisees), cls (homeroom), sq (squad), care, case (assigned), fac (faculty), camp (campus/school), all (central).
2a. Learner-facing and academic domains
Domain (level)
STUDENT
GUARDIAN
LECTURER / SS_TEACHER
ADVISOR / HOMEROOM
DEPT_HEAD / DEAN / SS_DIRECTOR
REGISTRAR
ADMISSIONS
Executives
Application and admission scores (L3)
CR own (APPLICANT); sees own per-station scores
R rel (minor applicant), consent
—
—
R/A fac (criteria, results)
R camp
CRU camp; override A (SoD-14)
R aggregate
Person profile and contact (L3)
R own; U via request
R rel
R sec (name, photo)
R adv/cls
R fac
CRU camp
R camp
aggregate only
National ID / passport (L4)
R own (masked)
—
—
—
—
R camp (unmasked for verification)
R camp (dedupe)
—
Guardian relations (L3)
R own; A observer consent (adult)
R own relation
—
R cls
A caregiver (SS_DIRECTOR)
CRU camp; verify level 1/2
—
—
Student status and records (L3)
R own
R rel (per consent if adult)
—
R adv
A fac (withdrawal, LOA)
CRUA camp
—
R aggregate
Registration and timetable (L2/L3)
CRU own
R rel (per consent)
R sec
A adv (study plan, add/drop)
A fac (offering plan, overload)
U camp
—
R aggregate
Attendance (L3)
R own; C leave
R rel; C leave (minor)
CRU sec; A sick leave
R adv/cls
A มส. list (DEPT_HEAD)
R camp
—
R aggregate
Grades and scores (L3)
R own (after teaching evaluation)
R rel (minor; consent if adult)
CU sec until submitted, then locked
R adv
R distribution; A batch (DEAN); A (SS_DIRECTOR)
R; publish camp
—
R aggregate
Grade corrections (L3)
C appeal own
—
C request sec
—
A (requester ≠ approver, SoD-02)
U publish
—
—
Discipline cases (L3)
R own; respond
R rel (minor)
—
—
A sanction (DEAN)
R outcome for graduation
—
—
Accommodation plan (disability) (L3) / evidence (L4)
Informed: minors always, adults only if life-threatening
—
—
—
PSYCHOLOGIST: CRU care; ADVISOR gets study restrictions only with consent
—
—
Safeguarding cases (L4)
C report (anonymous allowed)
Informed unless involved
—
C report
C report; alleged persons excluded
C report
CRUA case (assigned team only)
A measures (CAMPUS_VP)
Complaints and whistleblowing (L3/L4)
C (anonymous allowed); R own via tracking code
—
—
—
—
—
(routed)
COMPLAINTS_CENTER: CRU; INTERNAL_AUDIT: R case
Additional rules from the use cases:
Selection and retention decisions must not use health or psychology details, only readiness status (W-150, W-151).
ATT, ASM and EXM receive practical restrictions without diagnosis (W-39, W-33).
Alleged persons and their line managers are removed from safeguarding case access. HOU, ATH and NOTI receive only the restriction they must enforce (W-22, W-93, W-155).
Approving sensitive roles (health, safeguarding, finance approvers) needs certification by the DATA_OWNER during access recertification (W-126).
2c. Platform, governance and IT
Domain (level)
DPO
DATA_OWNER
INTERNAL_AUDIT
IAM_ADMIN
SECURITY_ADMIN
PLATFORM_ADMIN / DBA / HELPDESK
Role assignments (L3)
R
A sensitive roles
R recertification report
CRU
R; A privileged
—
Audit log (L3/L4)
R
R own domain
R
—
R
— (cannot alter)
Consent records (L3)
R; handle requests
U own domain (execute requests)
R
—
—
—
Bulk personal-data export
A 2nd (sensitive)
A
R log
—
—
—
Production data change
—
A business approval
R log
—
A 2nd (asm/rec/fin)
C request (HELPDESK L2); review script (DBA). No console edits
Privileged / break-glass sessions
Review within 24 h (break-glass); breach assessment within 72 h
A when business data is touched
R
—
A 1st; review session recording
Request
3. Authentication and session
User group
Sign-in
Extra assurance
UC
Applicants
ThaID, or e-mail + OTP. National ID / passport / G-code as the dedupe key
—
W-41
Students
SSO account created at reporting-in
MFA (W-142 exists for students); step-up with ThaID to change bank/PromptPay account and for PDPA requests
W-44, W-142, W-143, W-21
Guardians
ID number + OTP (provisional: notifications and payment only)
Level 1 in-person or level 2 ThaID to get full guardian rights
The full SoD list (SoD-01…18 and more) is in the team's Workflow book. Ask for it.
5. Privileged and emergency access
Control
Rule
UC
JIT privileged access (PAM)
Ticket-backed, time-boxed credentials; session recorded; production writes always reviewed; asm/rec/fin schemas read-only by default
W-124
Break-glass system account
Split credentials released by 2 approvers (SECURITY_ADMIN, CIO); SOC alerted; every command to WORM; review with DPO within 24 h; credentials rotated
W-125
Data fixes
Through the pipeline only, with before/after in WORM and re-signed snapshots
W-137
Access recertification
Periodic per-person review by line managers; uncertified access is revoked automatically
W-126
Acting / delegation
Recorded, time-bound signing authority
W-123
Staff working with children
StaffClearance with expiry; access to minors is suspended automatically when it expires
W-23, W-156
6. Audit and evidence
Event
Requirement
UC
Reads of L4 data (health, safeguarding cases)
Logged per read; reviewed
W-14, W-22
Status changes, approvals, role changes, consent changes
Audit log (AUD module)
W-127, W-128, W-133
Approved grade sets, regulatory submissions
Signed snapshot (hash) + receipt
W-01, W-35
Data fixes, break-glass commands
WORM storage
W-137, W-125
Bulk exports
Watermark (who, when), expiring link, audit entry
W-138
Emergency disclosure of contacts (vital interest)
Approver + audit
W-129
[inferred] Keep audit evidence separate from operational logs. OpenSearch is the centralised log store, but WORM evidence needs immutable storage (e.g. object lock on RustFS/S3). This is a decision to make, see 07-architecture-and-integrations.md.
7. Privacy rules that cut across modules
No PII in notification payloads (LINE, e-mail, SMS) (W-36).
National ID is masked in normal views [inferred]; full value only for verification roles.
Consent records include purpose, version and expiry, and are revocable with immediate effect (W-128).
Data-subject requests are checked against legal basis and RetentionClass before deletion (W-21).
Degree verification shows minimal fields, is rate-limited and offers no name search (W-67).
8. Open points
Confirm the classification levels and the domain list.
MFA for students and guardians: required or optional?
Which roles may see unmasked national ID numbers?
Retention periods per RetentionClass (configured by the university).
Sports-school equivalents for university approvers (who replaces DEAN, CAMPUS_VP at a school?).