How can I create a issues security scheme using the organization field?

[Gustavo Ezequiel Szemruck]

Good morning,

I need to implement an internal issues security scheme in a project with the following requirements:

1. When client X (reporter) creates a ticket, only that person and agent X, assigned to the same organization, should be able to view the issue.
2. Client Y, who belongs to a different organization, must not have access to client X’s reports.
3. Similarly, agent Y should not have access to tickets from an organization other than their own.

Clarification:
In this context, organizations are groups of clients representing the same department or area, such as Sales, Marketing, IT, etc. Each organization is defined based on its specific function or internal structure.

[Walter Buggenhout · Accepted solution]

Hi @Gustavo Ezequiel Szemruck,

That's not possible. Organizations are only available in JSM to share requests with their members on the portal. They don't have a function when it comes to granting permissions.

You'll need to use user groups to set up the desired behaviour. While there are long standing requests for this (see JSDCLOUD-4867), connecting groups to organisations is  not possible as of today.

Hope this helps!

[Gustavo Ezequiel Szemruck]

Hello, @Walter Buggenhout  and @John Funk ,

Thank you very much for your prompt responses. I understand that this functionality cannot be implemented because issues security schemes do not allow the use of native fields, and instead require the use of user groups.
If I start creating groups for each department, Atlassian implements them globally across the system. This is challenging for me, as I do not have enough knowledge to manage or design a scalable scheme that allows efficient user onboarding.

Context:
I have an active project based on an Atlassian help desk (nothing new) using the Jira Service Management IT template. The idea is to follow this workflow:

1. User: Wants to report an issue.
2. Help Desk: The user accesses the help portal and creates a ticket.
3. Agent: The agent from the same department views the report, filters the information, and decides whether to accept or reject the ticket.

Ticket acceptance process:

• The agent accepts the report.
• The IT department decides whether it can resolve the issue or transfer it to another project for a specialist in the area to handle it.

Ticket rejection process:

• The agent rejects the report.
• A reason for the rejection is provided.
• The response is sent back to the client.

Reason for the workflow:
This workflow is designed because, in many cases, the reports are basic issues that can be resolved at the first level (I handle the issue) and do not need to be escalated to the main project where the developers are working.

PS: My question is: Is it possible to create user groups that are scalable? My concern arises because this is a small company (PYME) where departments are likely to grow over time.

[John Funk · Accepted solution]

Hi Gustavo,

I don't believe you are going to be able to use the Organization field for that. You will probably need to create a custom user picker field (single or multi) and populate that. 

[John Funk]

I would not use Groups, I would create a custom field and populate it with the person(s) who need access. 

[Gustavo Ezequiel Szemruck]

Hello @John Funk ,

I’m thinking of doing the same, but the challenge is to achieve the following plan:

import java.util.Random;

String[] department = new String[10];

department[0] = "Digital Transformation";
department[1] = "Administration";
department[2] = "Sales Administration";
department[3] = "Executive Management";
department[4] = "Audit";
department[5] = "Comex";
department[6] = "Credits and Collections";
department[7] = "Logistics";
department[8] = "Reception";
department[9] = "Process Improvement";

// Random assignment number 

Random random = new Random();
int randomNumber = random.nextInt(10);

String nameReporter = "Pedro Iriso";
String nameAgent = "Gustavo";

// Assigning department to reporter

for (int i = 0; i < department.length; i++){
     if (i == 1) {
       String reporter = nameReporter + " " + department[i];
     }
}

// Assigning department to agent

for (int i = 0; i < department.length; i++) {

    if (i == randomNumber) { 
       String agent = nameAgent + " " + department[i];
    }
}

// Check

for (int i = 0; i < department.length; i++) {

 if (reporter.equals(department[i]) && agent.equals(department[i])) {     System.out.println("They are from the same department");
 }
}

Context: The logic is similar to the code I wrote in Java. First, I get a reporter and an agent. Then, each one is assigned a department. If their department matches, the incident security scheme is shown for that user. If not, it should not be visible.
On the other hand, what the AI recommended is to first create an automation that performs the check I’m looking for, and then integrate it into the scheme (the trigger is every time a new incident is created).

Link: https://poe.com/s/LWF9GZpreLDEN92zrKSm

[John Funk]

Yes, I would think the automation rule would be the route to go. But what you would do is apply the security level when the issue incident is created and then update the custom field with the user values that the security level uses.