Dashboard edit permissions

[Robert Ikeoka]

Is there an reason why only the owner of the dashboard can edit the dashboard?

From a security standpoint it adds an additional 3 steps per dashboard to edit in the event that an user accidentally share a dashboard with the Global ("Everyone") setting.  An admin cannot just edit the dashboard to change it to a compliant share setting, without changing the owner, then find the dashboard, edit the permission, then change the owner back to the original owner.

Additionally would it be possible to add a GET, DELETE, POST /rest/api/2/dashboard/{id}/permissions/ endpoint where an admin can systematically perform the permission cleanup?

[M]

You will want to use grant permissions to the Project Role(Users) and in your project configuration put the users you want to use that project in the Role for Users.

Group(anyone) allows anyone to see the issue anonymously without logging in. This means people outside your organization can see the issues if this group is used. For privacy reasons you will most likely never want to use Group(anyone). Unless you want outside users to view your issues and are okay with exposing that information.

[Nic Brough -Adaptavist-]

Actually, you often do want to use Group(anyone), with caveats: - As Marc says, you must be absolutely convinced that you want to expose that project to the world (or at least everyone who can reach your JIRA). For collaborative purposes, that's often VERY useful, and I almost always maintain my JIRA instances with a "JIRA Support" type project, which everyone *should* see. - You must only give them *browse*. Never anything that lets them change data - Previous to Jira 6.3, you needed to make sure you have a condition on every workflow transition (this is now covered by having to explicitly grant "can transition" in 6.3+) - and the killer - your JIRA can respond up to five times faster if you have Browse: Group (anyone)

[Nic Brough -Adaptavist-]

Short answer is "no".  I would strongly recommend having a business/admin rule that says "people always have to be in the users role, even if they are in other roles".  But you don't have to.  So there is nothing that says "a user "belongs" to a project".  You need to define a rule, or set of rules for yourself.

(For "anyone", see Marc's answer, it's spot on)