<commit_before>
# Access control

By default, course instances and assessments are only accessible to `Instructor` users. To change this, the `allowAccess` option can be used in the corresponding `infoCourseInstance.json` or `infoAssessment.json` file.

## `allowAccess` format

The general format of `allowAccess` is:

```
"allowAccess": [
    { <accessRule1> },
    { <accessRule2> },
    { <accessRule3> }
],
```
<commit_msg>clarify that assessment access rules stack onto courseInstance access; close #494<commit_after>
# Access control

By default, course instances and assessments are only accessible to `Instructor` users. To change this, the `allowAccess` option can be used in the corresponding `infoCourseInstance.json` or `infoAssessment.json` file.

## Two level of access control for assessments

In PrairieLearn there are two levels of access control to gain access to assessments:

1. First, a student or TA must have access to the **course instance**. This access is granted with the `allowAccess` rules in [infoCourseInstance.json](courseInstance.md). Giving a student or TA access to a course instance does not by default grant them access to any assessments in the course instance, however (see the next item).

2. Second, a student or TA must also have access to the specific **assessment**. This access is granted with the `allowAccess` rules in [infoAssessment.json](assessment.md). Even if a student has been granted access to an assessment, however, they will only be able to actually access it if they also have access to the course instance (see previous item).

Note that instructors for a course instance automatically have access to all assessments and questions in that course instance.

## `allowAccess` format

The general format of `allowAccess` is:

```
"allowAccess": [
    { <accessRule1> },
    { <accessRule2> },
    { <accessRule3> }
],
```

{'fraction_non_alphanumeric': 0.07925531914893617, 'fraction_numerical': 0.005851063829787234, 'mean_word_length': 4.717325227963526, 'pattern_counts': {'":': 2, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3907408', 'n_tokens_mistral': 497, 'n_tokens_neox': 474, 'n_words': 245}