How do I restrict access per issue type and per specific issue

[naftalib]

Hi,

I would appreciate help on:

1. How can I restrict a group of users to view only to specific issue types, and enable other groups to view edit the same issue type?

2. Assuming this is possible, can I still provide read/write access to specific issues of this type to the restricted group?

3. Can I also restrict the same group from viewing issue of specific type until it is reaching a specific state?

Many thanks, Naftali

[Nic Brough -Adaptavist- · Accepted solution]

Welcome to the Atlassian Community!

You have a couple of options here.  Jira's permission to do stuff with issues looks moderately simple at first glance: (a project has a permission scheme which has a load of rules about who can see the project, who can edit issues in it, log work, comment, transition, move and so on.

You will need to get the project level permissions right first, letting everyone who may be restricted by stuff I'm going to talk about lower down to do what they need to - there's no point in using restrictions or workflow to allow Bob to see or edit an issue if the project permission doesn't allow them to.

Option 1 - for restricting who can see an issue

The best way to do this is to set up an issue security scheme.  These are a set of rules similar to the "browse project" permission which are more conditional.  You set up a number of options and then a field you can set to one of the options controls who can see the issue,  The options are permission rules.  So you can tell Jira things like "When the security level is 'Top Secret' only Alice and Bob can see the issue" 

That is controlled entirely by a field, so if you wanted to do it by issue type, you would need to automate something that looks at the issue type and sets the security level as you need.

Option 2 - for restricting who can do things to an issue

You can put workflow properties into workflows.  These can change the permissions of the issues, overriding the project permissions, so that you can do quite complex rules like "While Bob has 'edit issue' permission in the project in general, so they can usually edit any issue, when an issue is in the status 'in  development', only Alice can edit it"

Because these are done in the workflow, you can associate them with issue types - the workflow scheme for a project can be set up to use a different workflow (with different properties) for each different issue type the project uses.

There are  two small caveats in all of that -

I have not tested the issue view with the workflow properties recently - I've not had any need to hide issues by issue type since security schemes got implemented, so it may have changed in later releases I am not sure you can stop people seeing issues by using workflow properties.

You can't use workflow properties or security schemes to prevent people creating issues of a certain type (but you can use security to hide new issues - Jira will tell users "You created XYZ-123, but you can't see it" when they do it).  For usability and collaboration, I strongly recommend that you do not do this to your people - the reporter should always be able to see issuesthey create, until another human sets a security level on it because it's sensitive (I've only ever seen a use for "hide from reporter" in HR incident tracking systems)

[naftalib]

Hi NIc, x 1000 great thanks, very helpful