Can you set create, read, update and delete rights separately?
Partly: for each module and role you set two rights, Read on its own, and Add, Update and Delete together. So a role can look without changing, or look and change, module by module.
That covers the usual split, such as an assistant who can see student records but not edit them, while the office can. Some modules show only one box because the other doesn't apply: advance reports and results can only be read, and certificates are only generated.