One row per section (size, assignments, avg completion), SCOPED.

Owner/admin get the school. Any other staff get the sections they personally teach — staff_section_ids, the same identity answer the attendance and plan surfaces on this page are scoped by — and nothing else.

Both halves of that matter, and the route has been wrong in both directions. _require_staff_role with no scoping handed a teacher the completion rates of all their colleagues' classes, which nobody had decided to ship; the fix for that was _require_admin, which then refused the teacher their OWN numbers. The whole Overview strip on the school dashboard is built from this one response, so a teacher with a section of twelve read "YOUR STUDENTS 0, across 0 sections you teach" above a banner naming those same twelve students (2026-09-12). A 403 the client swallows reduces to a confident zero, not to an error.

Narrowing the rows, rather than the door, keeps the privacy decision intact and answers the question the page is actually asking. A teacher wanting one section in more detail still has /groups/{group_id}/gradebook.