What strategies do you use for managing permissions and roles in large Jira projects?

[Jesse Hilton]

How do you keep Jira permissions and roles simple, secure, and scalable when many people are working on the same project?

[Prachi Bolar]

Hello,

Welcome to Community :) 

Use Project Roles as the Foundation

• Assign permissions to project roles (not individual users or groups) in permission schemes. This allows project admins to manage access at the project level without Jira admin intervention.
• Define clear roles  Developers, Testers, Project Admin that map to real responsibilities.
• Add users or groups to roles per project, enabling flexibility

2. Leverage Permission Schemes for Consistency

• Create permission schemes that define what each role can do, and reuse these schemes across multiple projects that can have same permission scheme
• Minimize the number of schemes—ideally, use as few as possible to reduce complexity and maintenance overhead.
• Copy and modify schemes for projects with unique requirement

3. Grating Permission

• Grant only the permissions needed for each role to perform their job.
• Restrict sensitive permissions (like Delete Issue, Manage Sprints) to trusted roles or individuals.
• Regularly review and audit permissions to ensure they align with current responsibilities and security policies.

4. Implement Issue Security for Sensitive Data

• Use issue security schemes to restrict access to specific issues within a project 
• Assign security levels to issues as needed.

Thank You,

Prachi

[Nikola Perisic]

Hello @Jesse Hilton 

First, I would prefer using project roles rather than groups, because roles are scalable. I would assign users to their specific project roles. For example you have product owner, developer, designer, scrum master. For your permission schemes, you want to grant your product owner the highest and most sensitive permissions:

• Administer Projects
• Delete Issues
• Edit Issues
• Delete Comments

Everything that is having a higher responsibility, I would assign it to the users with the highest decision making. 

Do you also need some issues to be visible by only some certain project roles? Apply issue security schemes.