The course roster is a pool member list, and the metal has one owner

The department rents one server for the semester into a pool the professor owns. Two TAs are pool admins. Every enrolled student is a user.

Roles are exact. Users deploy containers to the pool's servers and see who else is in it. Admins add and remove members, so week two's drop/add churn is theirs: POST /api/v1/pools/{id}/members and DELETE. Only the owner rents servers into the pool, changes its settings, or runs server commands; a TA who tries gets 403 No access to this server. When a student drops, delete the membership. Their containers stay for the incomplete-grade case; they just can't deploy new ones.

Nobody hands out SSH keys or shares the department's account. The professor's credit line and the TAs' roster duty are different roles on one object.

The course roster is a pool member list, and the metal has one owner.