Admissions Read Only Roles

I think it is a major controls issue that the Admissions role has the ability to change the student status (i.e. Application Complete, Accepted, Denied, etc.). I do not want our Admissions Counselors or student workers who need the ability to see and use the data to be able to change the application, accept/reject parts of the application, or complete, accept, or deny applications. The opportunity is there for a worker to waive certain requirements and push them through on their own without an administrator knowing. This is should be an easy fix that would negate this problem.