Set specific permissions on an Epic (and all Issues relating to it)

[Anders Hebert]

One of the Jira-projects in our organisation wishes to define who can access (view) specific Issues (or fields in an Issue). This is due to there potentially being sensitive information in the Issue Description field

Ideally all Issues that are added to a specific Epic called "Leads" should only be accessible to the Jira-projects administrators.

I have never used the Issue security screen before, as it is shared by all the Jira-projects in the organisation. I tried creating an automation rule, but it was too complicated for me to proceed.

We are using company-managed Jira-projects in our Jira Software (Premium) 

[Nic Brough -Adaptavist- · Accepted solution]

Hi Anders,

There's no way to apply permissions to Epics separately to the rest of the issue types in their project, nor apply them to a child issue of theirs.  Permissions are all done at the project level.

The best you can do is what you've started to try to do.  Create a new issue security scheme, or modify the existing ones (may be many because you are going to have to use this in every project).

Add a new "level" for "Leads", and set it to "role: project administrator"

Then you need an automation that 

• Runs on create issue
• Looks at the parent
• If the parent is your specific Epic, then set the security level to "Leads"

There is a problem with this - if one of your project admins edits the issue and changes the level to something else, you'll lose the security.  There's no way an automation can know why an admin might do this, but if you have a hard rule that they should never do it, you could add "runs on every issue edit as well as create" to the automation, so that any change to the issue would reset the security level.

Jira does not have field-level security, so you can't fulfil the second part of your request.

I would actually recommend that your people create a new, locked-down project and put all the secured issues in there, instead of trying to make a complicated bodge based on an Epic.

[Anders Hebert]

Thanks @Nic Brough -Adaptavist-  Just a follow-up question: Would this mean that all "project administrators" (in all projects) would have access - or would it be specific for just this project and/or Epic?
[for context: we have many different project administrators in different projects]

[Nic Brough -Adaptavist-]

No, if you did it with a separate project, all the permissions are local to that project.  You would have to add all your project admins to it as users, the project would not recognise them by "project admin somewhere else"