Put permissions on who can create user story issues?

[Ian Hayes]

Is it possible to put permission controls on who can create 'epic' and 'user story' type issues?

[Nic Brough -Adaptavist-]

Not really. A user in a project can either create issues (of any type) or they can not. You can play some tricks with fields to block them, or other javascript tricks to try to supress it in a browser (javascript is easy to bypass and won't work if they use REST etc).

[Ian Hayes]

I think this a major gap in authorization control

[Nic Brough -Adaptavist-]

I think it's a minor issue, but one that increased in severity when Epic and Story became special issue types in the Agile plugin.

Atlassian have stated they won't fix it though (sorry, I don't have my bookmarks to hand), on the grounds that it's not a serious problem and not many of us voted for it.