Best Practice -- Service Desk and privileged users

[Jeff Ullmann]

Currently we a have both a basic Jira and a Service Desk project.

Service Desk is used to document changes to production systems, infrastructure and releases. This information needs to be widely available inside the company so the rights are pretty lax.

Our need to is to start tracking much more sensitive information, for example, employees. Onboarding requests need to be approved, while technically it is OK if people know about the ticket, there is confidential information in the body and several people may need to contribute or view. Adding, removing rights and access to systems should require need approvals. On the other end, when someone leaves, only the necessary people should be aware of the ticket. It should not show up in queries by non-privileged users.

Right now we only have a couple of groups, so most people can see most things. 

Questions:

Should I create another Service Desk project in the same Atlassian Cloud instance?

Is it possible to define users and groups to in the current Service Desk project to provide the necessary isolation with newly defined requests?

Should I be looking at a different Jira project?

How have other people handled this?

[Jack Brickey]

While you certainly can add this to the existing project I would create a new JSD project for staffing. It will be cleaner and you can control access/permissions better. For example, your agents might be HR rather than IT. If you place this into your current projects then the IT agents would have access. While you could consider employing Issue Security IMO that is messier. I have a Staffing project dedicated for hiring, on-boarding and terminations.