Why is a person with just user permissions is able to move an item in the sprint itself?

[Tim Bachta]

I have a user that is set up with just the user permissions. The user permissions is locked down to have just ability to browse projects and create new issues. The user is not able to prioritize items in the backlog, which is what I want, but they are able to go into the current sprint and move items through the workflow. I do not want them to be able to do this, how is it they can? In the permissions schema the only role that is able to move items is the developer role.

[Nic Brough -Adaptavist- · Accepted solution]

Look at the workflow in Jira (rather than Greenhopper) - you'll find that they match the "conditions" on the transitions in the workflow and hence can perform them, which enables them to move issues between columns in Greenhopper.

The most common problem here is that there are NO conditions on the workflow, which means anyone can perform the transitions.

[Tim Bachta]

Thank you that worked.

[Lindsey Baron]

I've added conditions on all of my transitions that require a user to have the permission to edit an issue in order to execute the transition, but that user can still move items across the board. What am I missing here?

[Nic Brough -Adaptavist-]

They probably still have "edit" permission somehow. Check that the conditions are in place, and be careful to check exactly what the rule says. Then, check the user profile to see how they are matching it.

If in doubt, post the condition, in full, here, and then the user's profile for their groups and the roles that they may be in for the project you're looking at. If they all look right, it might be a support call to Atlassian.

[Lindsey Baron]

It was my fault. I was editing a draft, and I forgot to publish it. Stupid drafts.

[Nic Brough -Adaptavist-]

We've all done that :-) Me, repeatedly.

Drafts are a huge improvement over the older "have to migrate the entire workflow every time you change it" system, but have introduced their own issues - mostly that admins juggling workflows simply miss that they've not applied them. (Also, fellow admins for leaving 30 of them lying around to confuse you...)