Notre Dame has custom roles that go beyond the typical Instructor, TA and Student.
The Attendance tool however does not recognize these other roles and their permissions default to those of Instructor. So our roles of Guest (student-level access without ability to be graded) and Student Demo (= to Student) can both grade, edit, etc. in Attendance tool. There are no permissions listed in Administrative Workspace > Site Admin Permissions, and the tool has no permissions table to modify.
David Bauer mentions that "it's been on the list to refactor the tool to be based on permissions instead of roles, but that work isn't finished."
Noting here for posterity.