If I add a new Security Scheme to an existing project do I have to manually assign Security Levels?

[Richard Grey]

I need to prevent some users from being able to Browse Issues.  Rather, I would like to only allow this group of users to Browse specific Issues.

Therefore, I am trying to use Issue Security Schemes to accomplish this.  Nic Brough's example was very helpful.  

But, I am going to apply this new Issue Security Scheme to a project that never had Security Levels applied to the existing Issues.  And, I think that once I apply a new Issue Security Scheme to the project it will not apply the 'Default' Issue Security Level to all of the existing Issues.  If this is true, will I have to manually apply Issue Security Levels to all of my existing Issues?

[Nic Brough -Adaptavist-]

You have got it spot-on.

A security scheme defines a load of "levels" which then control visibility in clever ways, but when you look at an issue, the only data on there is "the current level". 

Jira does put some thought into it when you apply a new scheme but it's hard to explain in general, so here's an example instead:

Imagine a simple case where your existing security scheme has two levels, private and secret.  Any issue in the project could be unsecured, private or secret. 

You define a new scheme that has sensitive (default), confidential, and top-secret as the new levels. 

The good bit:  when you migrate to the new scheme, Jira will ask you what you want to move all the private and secret issues to in the new scheme. 

The bad bit: unsecured issues will not be defaulted.  As you have already worked out, you will need to run a filter for "level is empty in this project" and then use bulk-edit to set it to the default.