Demo Persona:School Admin / Designated Safeguarding Lead (DSL) • brian@tutorkamun.com

Brian Miller• Auth: Google Workspace SSO (@tutorkamun.com)•Target: brians-school.localhost:3000

Switch View:

Subdomain: other-school.localhost:3000 Mode: school

Other School[OTH]

Directory: conn_saml_other_sch_03 • Domain: @other-school.ac.uk • Clerk Org ID: org_3KRnLXu8XAlsIVLBslnAJ78VHDR

Active SubdomainIsolated

Currently scoped to Other School (other-school.localhost:3000).

Pupil Records for Other School

Postgres RLS enforcement: tenant_id = (auth.jwt() ->> 'org_id') = 'org_3KRnLXu8XAlsIVLBslnAJ78VHDR'

Pupil Name	School Email (SSO)	Year	SEND Status	Tenant Org ID
No pupil records found for Other School.

Enrol Pupil

Automatically scoped to Other School (org_3KRnLXu8XAlsIVLBslnAJ78VHDR).

Pupil Full Name

Pupil School Email (District SSO)

Used for SAML/OIDC SSO matching with Google Workspace SAML.

Year Group

SEND Classification

Provision Notes

Targeted 6-Week Re-engagement Cohorts

Small-group cohorts (max 8 students) with 1 Lead Specialist Tutor & 1 Teaching Assistant designed to transition affected pupils back into active learning. Enrol individual pupils or purchase all 8 slots for a dedicated school cohort with the whole-group discount.

KCSIE Compliant School DSL Child Protection Desk

Safeguarding & Session Incident Management

Statutory incident logging, behavioral alerts, and child protection disclosures raised during tutoring sessions. Isolated strictly to Other School pupils.

Active School Concerns

Recorded for this school's cohort

Immediate / Critical Attention

Urgent DSL action & parent contact

Escalated to DSL

Awaiting DSL assessment record

Resolved & Concluded

Actions documented in CPOMS audit

Showing 0 of 0 incidents

No Safeguarding Incidents in this View

All pupil interactions are currently calm and within expected thresholds.

Interactive Whiteboard for Other School

Room scoped to other-school-tutoring-room-101. Strokes broadcast over WebRTC data channels.

Disconnected

Loading Client Whiteboard...

Strokes Broadcasted: 0Room Scoped: other-school-tutoring-room-101

Waiting for changes...

Enterprise SSO Directory Configuration per School

Each school organization maintains its own Identity Provider (IdP) directory connection in Clerk B2B. Users entering from that school's subdomain or email domain are automatically routed to their dedicated directory.

Brian's School

connected

Subdomain:brians-school.localhost:3000

SSO Provider:Google Workspace (OAuth / OIDC)

Protocol:OIDC

Email Domain:@tutorkamun.com

Connection ID:conn_google_tutorkamun

Testing School

connected

Subdomain:testing-school.localhost:3000

SSO Provider:Okta Enterprise Directory

Protocol:SAML 2.0

Email Domain:@testing-school.sch.uk

Connection ID:conn_saml_testing_sch_02

Other School

connected

Subdomain:other-school.localhost:3000

SSO Provider:Google Workspace SAML

Protocol:SAML 2.0

Email Domain:@other-school.ac.uk

Connection ID:conn_saml_other_sch_03

Test Multi-Academy Trust

connected

Subdomain:test-org.localhost:3000

SSO Provider:Custom SAML Directory / PingFederate

Protocol:SAML 2.0

Email Domain:@test-org.ac.uk

Connection ID:conn_saml_test_org_04

School Identity & Tenant Personalisation

School Branding, Iconography & Administrator Team

Customise your school's visual identity, logo icon badge, brand palette, and designated school administrators. These settings reflect across your school portal and tutor reports.

Visual Branding & Iconography

School Crest / Icon Badge

Primary Brand Color

Presets:

Accent Color

School Campus Banner Image URL

Quick sample banners:

School Profile & Contact Details

School Name

School Code

School Motto / Tagline

Contact Email

Phone Number

Campus Address

Website

About the School & SEND Provision

Live Branding PreviewPortal View

Other School

Nurturing Potential, Rebuilding Confidence

School Admin Team (0)

Add Staff / SENDCo

Subdomain Isolation & SSO

<org-slug>.localhost:3000

Subdomain Routing: server/middleware/subdomain.ts extracts org slug from host header.
Cross-Directory Defense: server/utils/auth.ts verifies that active session orgId matches the subdomain org directory.
Directory Routing: Users from Brian's School cannot access other schools' pupils or boards.

Supabase Postgres RLS

Row-Level Security in eu-west-2

Caller Token Pass-Through: Supabase client injects caller's Clerk JWT.
Postgres Engine Check: Enforces tenant_id = (auth.jwt() ->> 'org_id').