diff --git a/HANDOFF.md b/HANDOFF.md
index 98f4970..3eeb3a5 100644
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -287,6 +287,26 @@ re-discovering it:
   `addons/tncsc_deployment/__init__.py` (`_remove_stock_homepage_page`,
   `_fix_website_menus`), both run from `post_init_hook`. Relevant if you
   add more top-level pages/menu items later.
+- Each product module's backend app (Membership, School, Benefits,
+  Classifieds, Interac Payments) has its root `ir.ui.menu` restricted to
+  its own manager/coordinator group, and a fresh `tncsc_deployment`
+  install doesn't put the `admin` user in any of them by default. Result:
+  admin's backend app switcher only shows stock apps (Events, eLearning,
+  Settings, ...) and none of the CommunityOS ones, which looks exactly
+  like "the modules aren't installed" even though
+  `ir.module.module.state` is `installed` for all of them — confirmed
+  by checking `env['ir.ui.menu'].with_user(admin).search([('parent_id',
+  '=', False)])`, which is the right way to check what a user actually
+  sees (menu visibility is group-based, not just install state). Fixed
+  by adding `admin` to `tncsc_deployment.group_tncsc_board_admin` in
+  `security/tncsc_roles.xml` (that group's `implied_ids` already covers
+  every product manager group) — this used to be the manual per-group
+  step described above for Phase 8's School Coordinator grant; it's now
+  automatic on any fresh install. Note `res.groups.implied_ids` doesn't
+  populate the implied group's own `user_ids` — checking membership via
+  `user in group.user_ids` will wrongly say "no" for an implied group;
+  use `user.has_group('module.xml_id')` instead, which does resolve the
+  transitive closure correctly.
 
 ## Handing off to a team
 
diff --git a/addons/tncsc_deployment/security/tncsc_roles.xml b/addons/tncsc_deployment/security/tncsc_roles.xml
index c8b34de..359e281 100644
--- a/addons/tncsc_deployment/security/tncsc_roles.xml
+++ b/addons/tncsc_deployment/security/tncsc_roles.xml
@@ -27,6 +27,16 @@
             (4, ref('community_interac.group_interac_verifier')),
             (4, ref('event.group_event_manager')),
         ]"/>
+        <!-- Without this, a fresh install leaves the installing admin user
+             out of every product-module manager group, so their backend
+             app switcher only shows stock apps (Events, eLearning, ...)
+             and none of the CommunityOS ones - each app's root menu is
+             group-restricted and admin isn't a member of any of those
+             groups by default. Confirmed empirically against a live
+             container; this is the automated fix for the manual step
+             HANDOFF.md previously described doing by hand for the School
+             Coordinator group alone. -->
+        <field name="user_ids" eval="[(4, ref('base.user_admin'))]"/>
     </record>
 
     <record id="group_tncsc_treasurer" model="res.groups">