Raise or lower this school's student wall: {"students_walled": true}.

The rule lives in services/student_wall.py, written for Ingrid's under-18s at TESI: a walled school's STUDENTS may reach only people who share one of their schools, and only students — staff keep the whole product. What was missing was any way to turn it on. The flag existed, the server enforced it, the nav hid CommuniTea for it, and the only way to set it was an UPDATE typed by an engineer against the database. A safeguarding control nobody can switch on is a safeguarding control that is off, and TESI started enrolling with it off.

Owner/admin, like every other school setting. That is a deliberate call over "platform staff only": the person accountable for those students is the coordinator, and making them file a ticket to protect their own minors is how a term starts unwalled. Symmetric, too — a school that can raise the wall can lower it. A coordinator locked out of undoing their own switch is a support ticket by another route.