3 Tier user permission

[Maik]

We want to have a setup for our users which defines 3 levels of accessibility within your Jira software. We call the usergroups “jira”, “keyuser” and “admin”.

Users in the “jira” group should do simple tasks like create issues and move them in the workflow. Users in the group “keyuser” should provide support to the users in the group “jira” on a project level. Create projects and acts as a first level support. Keyusers should neither make any changes to the application itself nor should they access the global permissions page. Users in the group “admin” should administrate the application, access the global permissions page and have access to any function within Jira.

To overcome this problem we tried to integrated a group for Keyusers which has not the global permission “Jira System Administration” but “Jira Administration”. The “admin” group has both global permissions.  After some testing Keyusers still have access to the workflow screen and the Global Permissions screen and can make changes that affect everybody.

How can we restrict the access level of keyusers to fit our needs that they support in the projects but are not allowed to make changes in the whole application which affects our company?

[Joe Pitt]

JIRA doesn't have the ability to do what you want out of the box. I would look for a plugin that handles it. 

[Matt Doar]

But it's pretty close. The only case I see listed that is hard is allowing non Jira administrators to edit workflows. Extended Project Administration may help with that somewhat. You mentioned system administration so I assume this is not Jira Cloud

I think you'd need to start with the docs for Jira project permissions, and project roles/groups