Restricting People Permissions

Question

Hello,

Looking for any guidance or insight on the ability to restrict Project Admins ability to change people permissions.  We'd like to allow our project admins to do just about everything within their given project, while not allowing them to change the people permissions and directly add/remove people and groups to the project (we are managing them more globally with combinations of Groups, Project Roles, and Permission Schemes).

Thanks for any insight you may have, appreciated.

Petru Simion [Simitech Ltd.] · Answer

Hi @Jeremy Yates ,

The Project Admins are allowed by default by Jira to add users to Roles.

The fact that a Project Admin adds users to Role has no effect on the final solution if it is not corelated with Permission Schemes.

You can have Role - Alpha, and have users X, Y Z assigned to the role.

If the Permission scheme does not associate the Role Alpha to any of the operations  in the Permission Scheme the Role just sitts orphan. So the fact that a Project Admin added those users to the role has no meaning.

So the Jira Admin will define the Permission Scheme and associate it to your project or projects.

When the Permission Scheme is defined the Jira Admin has in mind that later users assigned the Project Admin will have the ability to add users to Role, therefore to decide who can do what regarding to the defined Permission Scheme.

Each project, will have it's Project Admins, that need to understand clearly the Permission Scheme and only assign users to roles accordingly and they should understand who can do what in that specific project.

So in fact, what you are asking, that the Project Admin has limited ability to affect your project is already in place by how Jira designed the solution.

Shortly the Jira Admins decide the how, meaning how the Permission Scheme will be designed, and later, for each project, the Project Admins will decide the who, meaning who can do what, according to the already defined Permission Scheme.

At the beginning you will have only one Project Admin user.

That user in turn, because it is a Project Admin, will be able to not only add users to Roles but add other users to the Project Admin role.

So you and your team need to clearly understand the concept and apply it.

Regards,

Petru

Jeremy Yates · Answer

This is the unfortunate conclusion I am bringing myself to accept.

Jeremy Yates · Answer

Hi @Petru Simion  _Simitech Ltd__

I believe I've corrected the language above.  In short, we want only our Jira Admins to be be the only ones to be able to add/remove people and groups from a project, while allowing the Project Admins to do just about everything else within their given project.