User can create an issue they can't see (Issue Security Level)

Question

In previous instances I had setup a Security Level of private to which I'd granted permission via project roles and group assignments. Typically issues would be private by default.

So if a user didn't have permission they couldn't see private issues. Clients wouldn't be in a group or Project Role which had permission.

Similarly if a client created an issue, the Security Level would be empty because they didn't have permission to set it. So they could see the issue.

I believe that behaviour has changed. Someone without permission to set the Issue Security Level creates an issue and the Issue Security is set to private and of course they can't see it.

Is my impression of the designed behaviour and use of it correct and regardless - how can I work around this?

In an attempt to workaround this I've tried using workflow to set the level, but it doesn't work:

Remi_0fkuji · Answer

Not sure if entirely your use case but solved my desired scenario:

* By default issues created by our internal team should be private. 
* Post-create the security level can be changed manually to make issues visible for guests. 
* Guests should be able to create and see their own issues immediately after.

Would take too long to explain the many ways I tried. But here's the crux: We need multiple post-functions in the Create transition to achieve this.

--

Our setup:

* We have two Issue Security Levels configured in our scheme:* Internal Only
* Shared with Guests

* "Internal Only" is the default security level.
* Only internal team members have the "Set Issue Security" permission and can hide / share an issue by changing the level.
* Three post-functions are added to the "Create" transition in privilege-ascending order: Guests > Developers > Admin

Brendan Andrews_r9ny2c · Answer

@Ismael Jimoh can you please explain how Atlassian suggests to allow for issues to be confidential using security levels (or any other way)? Given that in the last 14 months or so the behaviour has changed.

Brendan Andrews_r9ny2c · Answer

I have found that if I move the line to set the issue security to the first line of the post functions it will work. Though this means workflows need to be paired with issue security schemes.