How I can restrict access to a board, but give issue reporters access to their own tickets?

[Matt Morgan]

Hi, 

My team has a restricted board due to the sensitive nature of some of the content. When people ask us to complete tasks, we have to create tickets and give feedback outside of the system, which is inefficient.

I've been playing with a new Jira project to see if I can retain a restriction on viewing all issues on the board but allow users to gain access to content reported in their name, but it doesn't appear to work. 

Below is what I have set up; perhaps someone can point me to the missing steps. 

---

I have created a blank Software project.

I created a new permission schema and removed "all logged in users" from browse access. 

I have created a new Security Level.

 I attributed it to my issues as the default setting.

Using the Permission check, I have confirmed that the reporter should be able to see the test ticket.

The user can see both the test ticket and the board. However they can also see other tickets which they are not a reporter too. 

If I remove the browse project permission, they can't see either the board or their own reporter ticket. 

---

Can anyone point me in the right direction or give me better permission to check with the Permission Helper? Checking for the ability to create comments or update fields on the ticket comes back with the same results as the image above for Browse Project. 

Thanks

[Trudy Claspill · Accepted solution]

Hello @Matt Morgan 

Welcome to the Atlassian community.

The Permissions apply to all issues in the project. You can't use those to restrict who sees which issues.

Instead you need to look at using Issue Security Schemes and Levels. Find the documentation for that here:

https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/

You can find additional free training from Atlassian on this topic in the Atlassian University.

https://university.atlassian.com/student/path/1933964-enhance-jira-project-security-using-schemes

[Matt Morgan]

Hi, 

Thanks for your reply. I believe this is what I did when I referenced " Security Level" in my initial post. 

I have created a issue security scheme as below and set to default on all tickets.

- Matt

[Trudy Claspill]

Hello Matt,

Did issues exist before you created and applied the Security Scheme to the project? 

Applying a Security Scheme to a project does not set the Security Level on issues that already exist. Those have to be set manually (or through Automation).

The default security level will be applied only to issues that are created after the Security Scheme is applied.

[Matt Morgan]

Hi Trudy, 

Thanks for your comments. You are correct; these tickets were created before the security policy was created. 

After creating a set of new tickets after security setup, the system works as expected. Thanks for your help here. 

Do you know of any way to see which security policy applies to which tickets? I haven't found these listed, but they may be helpful should we break this again. 

Thanks, 

- Matt

[Trudy Claspill]

You can add the Security Level column in the View All Issues output.

Original View Issues/Navigator/Search experience:

New View Issues/Navigator/Search experience: