How do you limit a work item being created within the Workflow?

[EASnoblen]

In Jira cloud, company managed software project. 

I'm trying to limit who can create a specific work item type by using the workflow properties.

This work item type is the only work item available in this workflow.

I've added jira.permission.create.group as a workflow property on the Create transition. The value for this property is the group ID from Atlassian admin.

In theory, only users in this group would be able to create this work type after the workflow is updated, but that is not the case. Any user with Issue Create is able to create this work type.  

What am I missing?

[Sai Krishna]

@EASnoblen , That's not how you restrict any one from creating issues. Under rules you should see a rule that says "Validate people have a specific permission" edit it and select administer project . That way only project administers will be able to create an issue. 
Have a nice day . 

[John Funk]

Hi @EASnoblen  - Welcome to the Atlassian Community!

Do I understand you correctly when you say there is only one Work type on the project? Or do you mean there is only one workflow on the project and it is utilized by all of the work types? 

[EASnoblen]

This one workflow (among many used in the project) has only one work item type.  We'd like to restrict the creation of that work type by security group (think org admin level) defined in Atlassian Admin.  

The Rules mentions above by Sai won't work for us as this is using the security schema's that are defined for the projects. There are many people who have project admin access within the projects.  Its specifically these individuals we want to block from having the ability to create this type of work item.

[John Funk]

Great - thanks for the clarification. In this case then you can edit the Permission Scheme used by the project to grant Create work items to that Group only. 

If the Permission Scheme is shared with other projects, then copy the Permission Scheme first, give the new scheme a unique name related to the project and save it. Then edit the new scheme to change the Create work items permission to be that Group only. Then edit the project settings for the project to replace the existing Permission Scheme with the new scheme. 

[EASnoblen]

Ya... that won't work. They need to create other work items in the project. They need the permission to create work item. We just want to limit it to this one work item in this one workflow that is part of all of our projects. 

https://support.atlassian.com/jira/kb/limit-edits-on-certain-jira-work-types-to-a-specific-group/

Use workflow properties | Atlassian Support 

I was using these 2 articles to help me with the workflow properties. I have limited transitions by security group with these workflow properties on other transitions... just not the Create transition.  My fear is that the Create transition is considered "system" and can't be modified with the workflow permissions - even though I've set them as I have on other transitions. The behavior seems to still be based off the Project Permission Scheme. 

[John Funk]

Oh, sorry about that - lost my mind for a minute. You will need a separate workflow for the work type you want to control. Then create a new Project Role or use an existing Project Role that would not otherwise be used on that project. Add the users to that project role. 

The select a permission in your Permission Scheme that is not widely used - something like View Voters and Watchers or, if you are not recording time on the project, then Delete Own Worklogs, or something like that. Add the Project Role to that Permission in the Permission scheme 

Then in the workflow, add a Validator to the Create transition and choose "Validate that people have a specific permission".  Then choose the Permission you attached to the unique Project Role in the previous step. 

[EASnoblen]

Ok. I see how that would work, but what a work around!  I'll talk to my business partner to see if they still want to pursue this.  Thank you for the clarification on roles and permissions schemes.  

[John Funk]

You are welcome and good luck with it. Let us know how it goes.