Can edit requests without Agent access in Next-Gen

[Harry Bob]

Hello,

I've noticed on my test instance that if a user has application access to JSD and has not been added as an agent to a project and the project has open access the user can log on and edit requests.

Why is that? I thought you need to be added as an agent to be able to do that

As you can see from my screenshot user prima**** is not an agent but does have access to JSD and can add internal and notes to the customer. 

I have refreshed my login for my user and logged in and out to make sure the settings are all applied correctly

[Harry Bob · Accepted solution]

So I managed to figure this out. If the project is OPEN anyone who has Application access will be able to access the project and add comments.

If you only want to allow Agents to be able to access that project you need to set it as private and then only users who are part of that speicific private project will be able to access and comment on that project.

OPEN project = Anyone with application access to JIRA Service Desk can access and can make comments

PRIVATE project = Need application access AND be added as agent to that project to access and make comments

[Gustav L_Estrade]

Hi @Harry Bob

I would suggest you to have a look at the permission scheme. By default, the behavior should be as you describe. However, it is possible to control which project role has what permission. Thereby, the prima*** user could have been granted Agent permissions without having the Agent role. 

Hope this helps!

[Harry Bob]

Hi @Gustav L_Estrade 

Thanks for the reply.

Im using a Next-Gen project so it doesn't use the permissions schemes if I'm not mistaken. If so thats why I'm confused as to why the agent can still edit.

Any other suggestions would be great!