What issue security settings for group-level security?

[Ryan Belmont]

Hi all,

Quick question. We're trying to allow client QA teams access to our Jira installation, but we're being cautious with the amount of information we make available. My current implementation of issue security allows our teams to see all issues on a project, but clients can only see issues they've created.

What I would like is an implementation where the client role can see all issues created by other members of the client project role. Does anyone have a suggestion for how I can implement this?

thanks,
Ryan

[Ronald Horner]

You will want to create another Security Level inside of our Issue Security Scheme granting privileges to members of the Client project role. Untested, but I think it should work. Maybe an example of your current implemenation would help.

[Ryan Belmont]

Yeah, it occurred to me that setting another security level up might be superfluous - what I'll probably end up recommending is that we give clients the ability to set security levels when creating issues. This will allow them to set an issue's security level to "none," which will ensure that their entire team can see it.

I was just hoping that I could do automated security levels based on project role. I.e, creating issues if you're role 1-5 means only people in roles 1-5 can see the issue, and if you're in role 6 you can only see role 6 created issues (but 1-5 can also see them).

[Nic Brough -Adaptavist-]

That's easy - just give the "client" role "browse".

I suspect I'm missing the actual requirement here though, but if you read back what you've said, it really does say "people in the Clients role can read any issue created by people in the Clients role".

[Ryan Belmont]

We also don't want to have to set a higher security level we don't want the client to see, so whatever security settings limit client visibility have to be the default security settings for an issue.

The only other solution I could think of was creating a new security level that clients could set themselves to grant visibility, but that seemed like a rough workaround.

[Ryan Belmont]

So the client role does currently have the ability to browse the project. To clarify my request, we don't want clients seeing the project plan or bugs that our QA team has created.

The scenario is that we have external (client) QA teams creating their own bug reports. Right now the default issue security setting is that only our teams, the issue reporter, and the issue assignee can see the issue. What I want is for everyone in the client role to be able to see every issue created by anyone else in the client role, and not anything else in the project.

Does that make any more sense?