Read-only on the question bank, roster and papers. Mastery scores are editable — those edits are the only thing the web layer writes, enforced by Postgres RLS (see supabase/migrations/20260609160100_rls.sql).