Is it possible to put permission controls on who can create 'epic' and 'user story' type issues?
Not really. A user in a project can either create issues (of any type) or they can not. You can play some tricks with fields to block them, or other javascript tricks to try to supress it in a browser (javascript is easy to bypass and won't work if they use REST etc).
I think this a major gap in authorization control
I think it's a minor issue, but one that increased in severity when Epic and Story became special issue types in the Agile plugin.
Atlassian have stated they won't fix it though (sorry, I don't have my bookmarks to hand), on the grounds that it's not a serious problem and not many of us voted for it.
It looks like you're new here. Sign in or register to get started.
