Issue Security granularity when an assignee is added

unknown

I am trying to create an issue security level for an HR project which of course contains sensitive issues not for all to see. My use case is that I have a list of 42 users who should be assignable users. These 42 users should only see an issue(s) if/when they become the assignee. That same user should NOT be allowed to see issues they are not assigned to. The other 41 users should not be allowed to see the issue that 1 individual sees when he/she is assigned. All users in this privacy scheme should not get Browse permission, or any other permission except for can be an assignee.Here is the desired scenario:

1. Users A through Z are included in the private-1 security scheme 
2. When user A is assigned an issue then User A can view the issue but users B-Z cannot
3. When user B is assignee on an issue then user A, C-Z cannot see the issue

If Browse permissions are required then I need the 42 users to only be able to browse for the only issue(s) they are allowed to view based on the security level.  Not sure it matters but the project type is a JSM. Does anyone know if this is even possible? Can I create a security level with such granularity?

John Funk

Hi SC,

Yes, this definitely should be possible. Create a Issue Security Scheme.

Then create a Security Level - Make it the default level.

Then click on Add. Select the Current Assignee. 

Also add either the Administrators group or Administrators project role so that someone besides the Assignee can see the issue. 

All will need the Browse Project permission in the permission scheme. 

Here is more information on Issue Level Security:

https://confluence.atlassian.com/adminjiracloud/configuring-issue-level-security-776636711.html