The default permissions that come with Level up! grant teachers and managers the rights to add the block and configure it, and grant students the ability to earn points and view the block and their level.
Here is a break down of the Level up!'s permissions.
This permission controls whether the user can add the block, and set some of its appearance settings. We strongly recommend that any user with this permission is also granted the permission block/xp:manage.
Prior to Level up! v3.6.1 this permission was needed to manage all other aspects of the plugin's instance, such as changing the settings, viewing the reports, etc... since Level up! v3.6.1 those were extracted to their own permission: block/xp:manage.
Introduced in Level up! v3.6.1
Users with this permission can manage all aspects a plugin's instance. They will be allowed to change any setting, the levels, the rules, the visuals, etc. Users will also have access to the report.
Prior to Level up! v3.10.0, this permission determined whether a user had access to the logs. This is now controlled with the permission: block/xp:viewlogs.
This permission determines whether the block will be visible to a user. When prohibited, a user will not see the block, and won't be able to access any of its pages.
Introduced in Level up! v3.10.0
This permission is required for users to get access to the logs.
Probably one of the most powerful capability, this controls whether a user can earn points for the actions they perform in the given context. Typically, non-students should not be given this permission in order to avoid for them to earn points and appear in the leaderboard.
Using this capability you may restrict entire sections of your course, or site from contributing to a user's experience points. For example, you may set this permission as Prohibited for the Student role for an entire category, subsequently any event occurring in a course or activity within this category will be ignored. You may do the same for a single course or even a single activity.
Moodle requires for this permission to be defined, it controls whether a user can add the block to their dashboard. By default it is not given to anyone, instead we advise for administrators to customise the default dashboard of their users.