Access rules for a school grade book

Design who can see and change what in a grade book app used by a school district with 40 schools, 30,000 students, 2,000 teachers and about 50,000 parent accounts. Teachers enter and edit grades for the classes they teach; students see only their own grades; parents see the grades of their own children; school administrators see everything in their own school; and a substitute teacher can be given access to one class for a set number of days. Grades are private student records. Describe the data model for these relationships, where the access checks happen, and how you make sure a bug cannot show one family another child's grades.