Suppose:
- An employee in your admissions office decides to pursue a degree from your school (like if they already have an MDiv and want to pursue your newly-approved DMin).
- Said employee completes an application and waives their right to view references.
- Because said employee works in the admissions office, they are able to view the references submitted in support of their application--both within Populi's interface and when they use their student-view provided (emailed) link to their application.
This strikes me as a bug of sorts. It's at least a confidentiality hole.
I'd like to see a change in Populi's application behavior such that if an employee is viewing an application that they submitted for a program, that application is read-only to that employee and the references are not shown. This restriction would apply to anyone who currently has the ability to view references, including account admins, when the application in question is their own.