Allow some users to view a specific Issue (and not others) in a project

[Matteo Napoleoni]

Hello everyone,

I have a project in Jira Cloud, called e.g. JIRA Test in which only members belonging to the groups "Project Manager" and "Project Users" can create/edit and view issues within the project. This was achieved by creating a permission scheme in which almost all fields such as "Browse Projects" field was restricted to the above-mentioned members only, as you can see in the image below.

No one else within the organization has permissions to see/edit what is in this project.

For various reasons I need to make sure that some members outside the project but belonging to the organization are able to see some specific issues assigned to them (I can also create another custom field if that helps) in that project without them being able to see the other issues within the project.

I've tried setting the Issue Security Schemes ( https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/ ) using the "Current assignee" setting without getting what I want.

Issue Security Schemes

From what I understand, it looks like the permissions scheme has a higher priority than the Issue Security Schemes.

How should I set up the two schemes to get what I want?

Thank you in advance.

Best Regards,

Matteo

[Riley Sullivan · Accepted solution]

To confirm, you want to limit the access to all issues in the project strictly to 'Project Managers' and 'Project Members'. However, any user in your company would only have access to an issue if they are the issue's current assignee. Is this interpretation correct?

Additionally, if a user, who is not part of either 'Project Managers' or 'Project Members' groups, is assigned an issue, do you want members of these two groups to retain their access to the issue?

Could you also share what aspects did not function as intended on the setup you hared above?

[Matteo Napoleoni]

Hi,

yes, this is exactly what I want (if it's easier I can also create a specific role for these users to just work the issue assigned to them).

I currently have two scenarios:

1- if in the browse projects field I only have the roles Project managers and Project members, even if I set the Issue Security Schemes in the project (with the Security Level set like the previous image) the user who is assigned the issue does not see either the project or the issue. And this is understandable in that, as confirmed to me by @Aaron Geister _Trundl_ 's post the Permission schemes are higher priority than the Issue Security Schemes.

2- I created another group called "Project involved users". I assigned "Browse Projects" permissions to this group and kept the Issue Security Schemes as before. In this case the user in this group can see all the issues in the project and not just the ones assigned to him. Which I do not want.

In the picture below the MN user is assigned to the [Task] visibility test but as you can see he can also see tasks that are not assigned to him.

[Riley Sullivan]

@Matteo Napoleoni 

So, 'Project Managers' or 'Project Members' will see all issues, even if they are not assigned. And 'other users' will only see issues they are assigned.

If I am understanding everything correctly, this is how you would be able to set it up.

Your understanding is correct, but let's rephrase it slightly to make it crystal clear.

Permissions

1. Set up all user roles ('Project Managers', 'Project Members', and 'other users') with basic access permissions. This includes 'Browse Projects', 'Assignable User', and others as per your project requirements. We'll restrict the 'other users' using security levels, not permissions.

Security Levels

Now, for the security levels, we want to ensure that 'Project Managers' and 'Project Members' can see all issues, while 'other users' can only see the issues assigned to them. Here's how you can do that:

1. Create a new Issue Security Scheme if you don't have one already. Within this scheme, create a Security Level.
2. For this Security Level, add 'Project Managers' and 'Project Members'. Also, add 'Current Assignee'.
3. Set this new Security Level as the 'default' for the Issue Security Scheme.

By doing this, both 'Project Managers' and 'Project Members' will be able to view all issues within the project, thanks to their inclusion in the Security Level. The 'Current Assignee' addition ensures that 'other users', when assigned an issue, can view their respective tasks. The 'default' setting ensures that every new issue created follows these rules, preserving the intended visibility and access control.

Ensure you assign this new Issue Security Scheme to your project.

Remember to test these settings thoroughly to confirm they're working as intended. Check different scenarios with different users to ensure everyone has the correct level of access.

Note: if you want this for all existing issues, make sure sure you transition them to the new security level

[Matteo Napoleoni]

Thank you very much!

It works but I would like to make a note that might be useful for other users.

The reason why it didn't seem to work to me is that the old issues in the project don't automatically get the new security level set.
This is confirmed by the image below:

The permissions can be changed by doing a "Bulk change" --> Edit Issues --> Change Security Level and in the drop-down menu choose the desired Issue Security Schemes

Note that the new Issue Security Schemes will only be visible if you have the right permission levels...

[Riley Sullivan]

Glad it worked! Happy I was able to assist!

[Aaron Geister _Trundl_]

@Matteo Napoleoni

Welcome and I hope to help spread some light on this issue for you.

Permission Scheme are used for project access so they will always have higher priority than issue security. They also allow users to have specific attributes within the project. Use case can be you have people who are view only or read only role and apply it to the Browse project permission in the scheme.

Issue security is for issue view permission (which is to restrict view of specific issue from others sight by group,or like current assignee). Another great example of this is a "Managers" view so you have a group for Managers and apply that to the issue security scheme so you can set specific issues to only "Managers" view

If the users does not have browse project permission they will not be able to see the issue with issue security because the first permission they need is "Browse Project" in which they will need to be in the group,role in that permission to access.

Here are a few confluence articles to help with Permission and issue security.

Permisson scheme
https://support.atlassian.com/jira-cloud-administration/docs/manage-project-permissions/

Issue Security
https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/


I hope this helps  kind regards

Aaron