Some general privilege pointers:
1) Students should never create tools. When staff create things we tag what college the item belongs too. This allows other people in your college to find things on the Unit tab if someone leaves. If students create things you won't be able to find it later.
2) Create admin staff, manager staff, admin student and manager student security groups in the Group Manager. Then for calendars, forms, etc on the Permissions tab assign the appropriate groups to the proper roles. That way if a student leaves tomorrow you remove the student from one or two groups in the Group Manager wrather than going into every tool and changing the permissions.