Why is jira security way too complicated?

[Nic Brough [Adaptavist]]

Because it's powerful.  It also has some quirks that have been inherited from old versions, but they're not too hard to work with.

Where are you struggling with?

[Joseph Pitt]

The basic premise is you grant access, not prevent access. Most people get in trouble by thinking about restricting access to a particular group of users. 

[Teilor Soares]

Did you already read our overview doc on JIRA security? I believe this doc is the first thing you should read to understand JIRA security:

https://confluence.atlassian.com/display/JIRA/Configuring+Security

Cheers!
Teilor