Jira Permissions Explained: How to Set Up Project Security Without Breaking Workflows
Jira permissions control who can view, create, and modify issues. Use permission schemes, project roles, and issue-level security to balance access with data protection.
- The difference between global, project, and issue-level permissions
- How to create and configure permission schemes in Jira
- How to set up project roles for flexible, role-based access control
- How to restrict issue visibility with issue-level security
- How to test and audit permissions to verify correct configuration
Permissions in Jira control who can do what. Without proper configuration, either everyone can see everything (security risk) or the permissions are so locked down that work stops (productivity risk).
The key is finding the balance: enough access for people to do their jobs, not so much that sensitive data is exposed. This guide covers how to configure Jira permissions without breaking workflows.
Why Permissions Matter
Permissions are not just a security checkbox. They directly impact:
Data security. Sensitive projects (HR, Legal, Finance) should not be visible to the entire organization. Proper permissions prevent unauthorized access.
Workflow integrity. Without role-based transitions, anyone can move issues through the workflow. This breaks process discipline and creates audit trail issues.
Compliance. Many industries require access controls and audit trails. Jira permissions provide both when configured correctly.
User experience. Too many projects in the sidebar overwhelm users. Proper permissions show only what is relevant to each person.
How Jira Permissions Work
Global Permissions
These apply across all projects:
| Permission | What It Controls |
|---|---|
| Jira System Administrators | Full admin access to Jira |
| Jira Administrators | Project creation, user management |
| Browse Users | Can search for and mention users |
| Create Issues | Can create issues in any project (if project permissions allow) |
| Manage Group Filter Subscriptions | Can manage shared filters |
Where to configure: Jira Settings > System > Global Permissions
Project Permissions
These apply within a specific project:
| Permission | What It Controls |
|---|---|
| Browse Projects | Can see the project in their project list |
| Create Issues | Can create new issues |
| Edit Issues | Can modify existing issues |
| Resolve Issues | Can mark issues as resolved |
| Close Issues | Can close resolved issues |
| Delete Issues | Can delete issues (use with caution) |
| Transition Issues | Can move issues through the workflow |
| Assign Issues | Can assign issues to users |
| Schedule Issues | Can set due dates |
| Comment on Issues | Can add comments |
| View Developers | Can see who is assigned to issues |
Where to configure: Project Settings > Permissions
Issue-Level Security
This controls who can see specific issues within a project:
| Scheme | What It Does |
|---|---|
| Issue Security Scheme | Restricts issue visibility based on reporter, assignee, group, or role |
Use cases:
- HR issues visible only to HR team
- Security incidents visible only to security team
- Executive issues visible only to management
How to Set Up Jira Permissions: Step-by-Step
1. Create or Modify a Permission Scheme
For existing projects:
- Go to Project Settings > Permissions
- Review the current scheme
- Add or remove permissions as needed
- Save the scheme
For new projects:
- Go to Jira Settings > Issues > Permission Schemes
- Click Create Permission Scheme
- Name it (e.g., "Software Development Permissions")
- Add permissions for each role
- Assign the scheme to your project
Recommended permission matrix:
| Permission | Developer | QA | Product Owner | Stakeholder |
|---|---|---|---|---|
| Browse Projects | Yes | Yes | Yes | Yes |
| Create Issues | Yes | Yes | Yes | No |
| Edit Issues | Yes | Yes | Yes | No |
| Resolve Issues | Yes | Yes | Yes | No |
| Transition Issues | Yes | Yes | Yes | No |
| Comment on Issues | Yes | Yes | Yes | Yes |
| Assign Issues | No | No | Yes | No |
| Delete Issues | No | No | Admin only | No |
2. Set Up Project Roles
Roles are more flexible than groups because they are project-specific.
How to create roles:
- Go to Jira Settings > Projects > Project Roles
- Click Add Project Role
- Name the role (e.g., "Developer", "QA", "Product Owner")
- Add a description
How to assign users to roles:
- Go to Project Settings > People
- Click Add People
- Select the user and role
- Click Add
Recommended roles for software teams:
- Developer — can create, edit, transition issues
- QA — can create, edit, resolve issues
- Product Owner — can create, edit, assign, resolve issues
- Stakeholder — can browse and comment only
- Scrum Master — full access except delete
3. Configure Issue-Level Security
For sensitive issues, use issue security schemes:
How to create an issue security scheme:
- Go to Jira Settings > Issues > Issue Security Schemes
- Click Add Issue Security Scheme
- Name it (e.g., "Confidential Issues")
- Add security levels:
- Reporter Only — only the reporter can see the issue
- Assignee and Reporter — both can see, others cannot
- Specific Role — only users in a role can see
- Specific Group — only members of a group can see
How to apply issue security:
- Go to Project Settings > Issue Security
- Select the scheme
- Issues created in this project will follow the security rules
4. Test and Audit Permissions
Before rolling out permission changes, verify they work:
Permission Helper:
- Go to Project Settings > Permissions > Permission Helper
- Enter a username
- Select an issue or operation
- Jira shows whether the user has permission and which scheme grants it
Audit checklist:
- Can users outside the team see the project?
- Can users create issues without proper fields?
- Can users transition issues they should not?
- Are sensitive issues hidden from unauthorized users?
- Do stakeholders have read-only access as intended?
FAQ
What is the difference between project roles and groups in Jira?
Groups are global — a user is either in the group or not, across all projects. Project roles are project-specific — a user can be a Developer in Project A and a Stakeholder in Project B. Roles are more flexible and recommended for permission schemes.
How do I check what permissions a user has?
Go to Project Settings > Permissions > Permission Helper. Enter the username and select an issue or operation. Jira shows whether the user has permission and which scheme grants it.
Can I hide a project from certain users?
Yes. Remove the 'Browse Projects' permission from the project permission scheme for the groups or roles you want to exclude. Users without this permission cannot see the project in their project list.
What happens if a user has conflicting permissions?
Jira uses additive permissions — if a user has permission through any role or group, they have it. There is no 'deny' in permission schemes. To restrict access, remove the user from all roles and groups that grant the permission.
How do I restrict issue transitions to specific roles?
Go to Project Settings > Workflows > Edit. Click the transition (e.g., 'Start Progress'), add a permission condition, and specify the role (e.g., 'Developers'). Only users in that role can execute the transition.