A school on the portal is a tenant: everything inside belongs to it and is invisible from the outside. The role decides what a person sees within those walls and what they may change.
Who can do what
Owner. The person who created the school. Pays, can close the school, and can do everything the others can. There is one owner.
Admin. Runs the content: courses and lessons, streams, enrolment, question sets, invoices, branding and the custom domain.
Teacher. Runs their own streams: creates and marks assignments, gives verdicts on written answers, schedules webinars, writes in the chat, issues certificates.
Student. Learns: reads lessons, submits work, takes tests, sees their own results and their own certificates.
Why a teacher cannot enrol students
Enrolling and removing students is refused for teachers, and that is a decision rather than a forgotten check. Enrolment is money and paperwork, not a timetable: the invoice the school issues rests on it. So the roll is kept by the administration, and a teacher is handed a group that is already assembled.
For the same reason invoices and school settings are hidden from teachers and students alike. Sums, legal details and payment dates are the administration's business.
The invitation carries the role
You cannot change someone's role from the team list: the portal has no such operation at all. The role is written into the invitation the person accepted — "invite as a teacher" and "invite as a student" are two different links.
This keeps permissions from drifting in passing. If a role really has to change, invite the person again with the role you want.
Someone else's school answers "not found"
Open a link to a school, a stream or a submission that is not yours and the portal says "not found" rather than "access denied". The difference matters: "denied" would confirm that the thing exists, and the existence of a school is none of an outsider's business. The same rule applies inside a school — a student who opens a classmate's work gets "not found".
One person, several schools
A person has one account and may belong to several schools: teaching in two, studying in a third. The role is separate in each of them.
Name, city and colour scheme are not: they belong to the person, travel with them and live under their name in the header, not in the school settings a student never sees.