JIRA Cloud – Security Level Not Restricting Access to Sub-Task as Expected

[Jim Gould]

Configuration Overview:

• Security Scheme: A Security Scheme has been set up in Jira Cloud that includes a single Security Level called "data".

• Security Level Access: This "data" Security Level is configured to only allow visibility to a specific group of users "Testers".

• Automation: A Jira Automation rule is in place to automatically set the Security Level of any sub-task with the issue type "Data" to "data" upon creation.

• Behavior Observed:

  • When I view the "Data" sub-task created, the issue shows the blue lock icon with Security Level "data" — indicating that it has been set correctly.

  • However, users who are not part of the allowed group can still:

    • View the sub-task in issue listings

    • Open and read its details

    • Do so without seeing the blue lock icon, suggesting the Security Level was not applied for them.

What am I missing, I appreciate the help.

~Jim

[Piyush Annadate _ACE Pune_ · Accepted solution]

Hello @Kai Krause ,
Can you share the Parent security and subtask (child) security lock icon details.

[Kai Krause]

Hi,

in the example is is shown https://community.atlassian.com/forums/Jira-questions/Re-Re-JIRA-Cloud-Security-Level-Not-Restricting-Acces/qaq-p/3011144/comment-id/1122516#M1122516

[Piyush Annadate _ACE Pune_]

Sorry, the question was for @Jim Gould .

[Jim Gould]

@Piyush Annadate _ACE Pune_  The Parent ticket does not have a Security Level set, only the subtask.

Appreciatethe help.

~Jim

[Piyush Annadate _ACE Pune_]

Hi @Jim Gould ,
So here's the case - a subtask will always take up the parent security level. 

Let's say, I have P-1 and P-2, P2 is subtask for P1. Added a security level for P2 , which won't be done, as P1 (parent) doesn't have security level.  (Security level is for assignee only)
Now, I did applied Security level for P-1, and that got applied to P-2. But I was assignee on P-2 and not for P-1 (parent_ ; hence I was not able to see  parent but was able to see P-2 and that too without the parent details being mentioned.

That's how it works !! 

[Jim Gould]

It seems to me that the child can have a higher security than the parent just never a lower. Not crazy about this model Atlassian.

@Piyush Annadate _ACE Pune_ thank you for the heads up.

~Jim

[Kai Krause · Accepted solution]

Hi,

i think the sub-tasks is a part of the parent issue. 

So the sub-task gets the same security level, as thee parent-issue.

Hope i get the topic. 

BR

Kai

[Kai Krause]

As exampel 

A story with a child-item . Issue-Security Level is not set (Open Lock Icon) 

The Child-Item has a sub-task -Issue Security set (red, closed Lock Icon)

In the subtask the securioty level is set ( red closed icon )

I can chan ge in the subtask the level or remove it, but it has no effect and is reverted back to level ob the parent . 



Hope it helps to find the topic. 

BR
Kai 

[Jim Gould]

@Kai Krause thank you for the answer makes mechanical sense but not logical sense.

~Appreciate the help, Thank you, Jim