Limit access to issues only for involved users

[Mohammad Forghani]

Hi all.

I'm new to jira service desk and I need to hide issue not related to users while it step forward in workflow. I've found security level to limit access to issue but I want it to be dynamic. I've search a lot but didn't find any straight forward solutions.

I asked chatGPT and it says:

To configure Jira so that people who have been involved or assigned to a
ticket can see the ticket even after the workflow has passed their step,
you need to modify the issue-level security settings. You can create a
new security level and update the workflow to assign that security level
to the issue at the appropriate points.

Here are the steps to achieve this:

Create a new custom field:

Go to Jira Settings (cog icon) > Issues > Custom Fields.
Click Add custom field and select User Picker (multiple users) field type.
Enter a name for the field, like "Involved Users," and click Create.
Create a new issue security level:

Go to Jira Settings (cog icon) > Issues > Issue Security Schemes.
Click on the security scheme associated with your project, or create a
new one if necessary.
Click Add security level and enter a name, like "Involved Users Only."
Add a new security rule to the new security level:
Click Add and select User Custom Field Value.
Choose the "Involved Users" custom field you previously created.
Click Add.
Apply the issue security scheme to your project:

Go to Project Settings > Permissions.
Click Actions (three dots) > Use a different scheme and select the issue
security scheme you modified in step 2.
Modify the workflow to add involved users and set security level:

Go to Project Settings > Workflows.
Edit the workflow associated with the issue types you want to configure.
For each transition where you want to add the involved users:
Click on the transition, and then click Post Functions.
Click Add post function and choose Update Issue Custom Field.
Select the "Involved Users" custom field and set the value to
%current_user%.
Click Add.
For each transition where you want to set the issue security level:
Click on the transition, and then click Post Functions.
Click Add post function and choose Set Issue Security Level.
Select the "Involved Users Only" security level you created in step 2.
Click Add.
Publish the new workflow.
Now, whenever an issue passes through one of the configured transitions,
the current user will be added to the "Involved Users" custom field, and
the issue security level will be set to "Involved Users Only." This will
allow the involved users to see the issue even after the workflow has
passed their step.

but still can't find the way to implement it and wondering if it is applicable.

any help is welcomed. thanks a lot

[Jack Brickey]

Hi @Mohammad Forghani ,

i'm unsure if I'm following you here. What do you mean by do you need to make it more dynamic? Are you asking for a means of hiding issues from certain users under certain conditions but later, exposing the issue to them? If so, there isn't a way to do that OOTB. As you found, there is issue level security, where you can hide issues from individuals based upon Issuetype.

[Mohammad Forghani]

Thanks for quick response.
let me describe with an example:
we have 20 users: user1, ... , user20.
we have workflow with 5 status. user1 create it, passes to user2 at step 2, users2 decides for next step to assign to user3 or user4 or user5.
if user2, assign to user3, ONLY user1, user2 and user3 should have access to the issue and it's not accessible to any other users.

[Jack Brickey]

I think you should assess what having access to an issue really means for your requirements. For example, do you really need to hide the issue or simply restrict who can take action on the issue, e.g. transition. OOTB you cannot hide an issue based upon the current status of the issue but you can restrict the ability to transition the issue.

[Mohammad Forghani]

I want to hide and restrict access and take action to issue, only to whom it will assign to.

that's very nice of you if read these again and confirm it if it's possible or not:

To configure Jira so that people who have been involved or assigned to a
ticket can see the ticket even after the workflow has passed their step,
you need to modify the issue-level security settings. You can create a
new security level and update the workflow to assign that security level
to the issue at the appropriate points.

Here are the steps to achieve this:

Create a new custom field:

Go to Jira Settings (cog icon) > Issues > Custom Fields.
Click Add custom field and select User Picker (multiple users) field type.
Enter a name for the field, like "Involved Users," and click Create.
Create a new issue security level:

Go to Jira Settings (cog icon) > Issues > Issue Security Schemes.
Click on the security scheme associated with your project, or create a
new one if necessary.
Click Add security level and enter a name, like "Involved Users Only."
Add a new security rule to the new security level:
Click Add and select User Custom Field Value.
Choose the "Involved Users" custom field you previously created.
Click Add.
Apply the issue security scheme to your project:

Go to Project Settings > Permissions.
Click Actions (three dots) > Use a different scheme and select the issue
security scheme you modified in step 2.
Modify the workflow to add involved users and set security level:

Go to Project Settings > Workflows.
Edit the workflow associated with the issue types you want to configure.
For each transition where you want to add the involved users:
Click on the transition, and then click Post Functions.
Click Add post function and choose Update Issue Custom Field.
Select the "Involved Users" custom field and set the value to
%current_user%.
Click Add.
For each transition where you want to set the issue security level:
Click on the transition, and then click Post Functions.
Click Add post function and choose Set Issue Security Level.
Select the "Involved Users Only" security level you created in step 2.
Click Add.
Publish the new workflow.
Now, whenever an issue passes through one of the configured transitions,
the current user will be added to the "Involved Users" custom field, and
the issue security level will be set to "Involved Users Only." This will
allow the involved users to see the issue even after the workflow has
passed their step.

[Jack Brickey]

You cannot hide the issue based on assignee. You can prevent transition based on assignee.