Restricting Issue Visibility with Jira Issue Security Levels

The Problem: Over-Exposure of Sensitive Issues

Standard project permissions in Jira are often too broad; if a user has the 'Browse Projects' permission, they can typically see every issue in that project. When dealing with HR disputes, legal reviews, or executive planning, you need a way to hide specific issues from the general project membership without creating entirely separate projects.

The Takeaway: Use an Issue Security Scheme to create named visibility rules. By assigning a security level to an issue, you override the project's general browse permissions, ensuring only a specific group or project role can see that record.

Prerequisites

• Permissions: You must be a Jira Global Administrator to create and manage security schemes.
• Plan Requirements: For Jira Cloud, this feature is available on Standard, Premium, and Enterprise plans. It is not available on the Free plan.
• Target Groups: Identify the specific Jira groups (e.g., hr-managers) or Project Roles (e.g., Project Lead) that require access to the restricted issues.

Configuration Procedure

1. Define the Issue Security Scheme

A scheme acts as a container for one or more security levels. You can reuse the same scheme across multiple projects to maintain consistent visibility rules.

1. Navigate to Administration > Issues > Issue security schemes.
2. Select Add issue security scheme.
3. Assign a descriptive name, such as Personnel-Confidential-Scheme, and click Add.

2. Create Security Levels

Security levels are the actual rules that define who can see the issue. An issue can only have one security level assigned at a time.

1. In the scheme list, click Security Levels next to your new scheme.
2. Click Add security level.
3. Enter a name (e.g., Private-HR).
4. Under the Users and groups or Project roles section, add the authorized entities. For example, add the hr-admins group.
5. Save the level.

3. Bind the Scheme to a Project

The rules will not take effect until the scheme is associated with a specific project.

1. Go to Project settings > Issue security.
2. Select your scheme from the dropdown menu and click Associate.
3. Note: Existing issues in the project that do not have a security level assigned will remain visible to anyone with the 'Browse Projects' permission.

4. Assign the Level to Issues

Once the scheme is active, the Security Level field becomes available on the issue screens.

1. Open the target issue.
2. Locate the Security Level field (ensure it is added to your Screen configuration if not visible).
3. Select Private-HR from the dropdown.

Verification and Testing

To ensure the restriction is working as intended, perform the following diagnostic checks:

Limitations and Risks

• Application-Layer Filtering: Issue security is a visibility filter within the Jira UI. It is not encryption. Users with direct database access or certain system-level API keys may still see the data.
• The "Invisible Issue" Trap: If you delete a security level that is currently assigned to issues, those issues may become invisible to everyone except Global Administrators. Always reassign issues to a different level or "None" before deleting a level.
• Admin Bypass: Users with the Jira System Administrators global permission can view all issues regardless of the security level.

Rollback Procedure

If you find that too many issues have become hidden or the scheme is misconfigured:

1. Navigate to Project settings > Issue security.
2. Switch the scheme back to None or a previous scheme.
3. Confirm the change. All issues will revert to being governed solely by the Project Permission Scheme (Browse Projects permission).