one of the documented procedures in this installation of the ACS
edu_set_class_roles_and_actions   db   class_id
What it does:
This takes a class id and a database handle and sets up the class permission options. This should be called when a class is first created and we want to set up all of the permissions.
Defined in: /web/philip/tcl/education.tcl

Source code:

    set roles [edu_get_class_original_role_pretty_role]
    set role_action_map [edu_get_class_roles_to_actions_map]
    set action_list [list "Manage Users" "Add Tasks" "Edit Tasks" "Delete Tasks" "Edit Class Properties" "Manage Communications" "Edit Permissions" "View Admin Pages" "Evaluate" "Spam Users" "Submit Tasks"]

    #the first thing we want to do is add all of the roles
    foreach role $roles {
	ad_user_group_role_add $db $class_id [lindex $role 0]
	# the trigger will have done the insert so now we update
	# the information
	ns_db dml $db "update edu_role_pretty_role_map
                       set pretty_role = '[lindex $role 1]',
                           pretty_role_plural = '[lindex $role 2]'
                       where role = '[lindex $role 0]'"

    #now, add all of the roles
    foreach action $action_list {
	ad_user_group_action_add $db $class_id "$action"

    #now, map the roles to the correct actions
    foreach role_action $role_action_map {
	set role [lindex $role_action 0]
	set action_list [lindex $role_action 1]
	foreach action $action_list {
	    ad_user_group_action_role_map $db $class_id $action $role