I have created a security group "Check-in Managers" and gave them View and Edit permissions to the "Check in Management" page, which cascades to all of it's sub-pages and blocks, and has worked well.

But when our check-in kiosks went offline for a few minutes and they had to use our backup handwritten system (we have pre-printed coded nametags for this purpose), they need to be able to go back and add the students who were manually checked in. So I linked them to the Attendance Analytics -> Check-in Details page, which has check-in buttons similar to regular attendance-taking groups, so they can add attendees. (http://rock.rocksolidchurchdemo.com/page/5335?GroupTypeIds=16%2c15%2c17%2c18%2c19%2c20%2c21%2c22&GroupId=27 on the demo site).

They can see the group types and the links to the groups themselves on the left side, as well as all of our past check-in schedules on the right side when they select a group. But when they click the checkmark button, they get the message that they're "not authorized to update the attendance for the selected group".

The only methods I've found to enable them to edit the attendance, is to either give them edit permissions on each group individually, or else on the group type. Since these are check-in groups, the group types change from time to time as ministries restructure, so I'm hoping there's a more global place I can add their permissions that would get inherited by the checkin group types themselves. Otherwise we'll have to remember to set these permissions afresh anytime the checkin structure changes.

I've tried adding the permission to the "Check-in by grade" group type, to no avail - those permissions do not get inherited by the groups that inherit the check-in settings from that group type (since they're not actual group type descendants). I don't believe the GroupTypes have a true concept of "parents" or cascading permissions, but I'm hoping someone knows differently, and there's a place I can add these edit permissions which will permit my check-in managers to edit attendance by default on any check-in groups that may get created in the future.