Using Jira Issue Security Schemes to Restrict Issue Visibility

Using Jira Issue Security Schemes to Restrict Issue Visibility

If you need to hide certain issues from most users while allowing a specific group (e.g., external clients) to view them, configure an Issue Security Scheme.

Configuration Steps

1. Go to Jira Administration → Issues → Issue Security Schemes and click Add Issue Security Scheme.
2. Name the scheme (e.g., Project X Security) and add a description.
3. Click Add Security Level, enter a level name (e.g., Client View) and select the group or project role that should see issues with this level (e.g., group Clients).
4. Save the scheme.
5. Assign the scheme to the project: open the project, choose Project Settings → Permissions → Issue Security Scheme, select the scheme you created, and save.
6. Edit the workflow that governs the issue type. Add a post‑function to the transition where you want the level applied (for example, the Close transition). Choose Update Issue Field, set the field to Security Level, and pick the level you created (Client View). Publish the workflow.
7. Create a test issue, set its security level to Client View via the issue view or let the workflow apply it, then log in as a user outside the Clients group and confirm the issue is not visible.

Limits

• Security levels are scoped to a single project; they cannot be inherited by other projects.
• The scheme does not automatically protect attachments or issue links unless the linked item shares the same security level.
• Each visibility check adds a database lookup, which can affect performance in very large instances if many levels are used.

Common Mistakes

• Forgetting to add the security level to the workflow transition, so issues retain the default level.
• Typing the group name incorrectly or using a group that does not exist, causing the level to have no members.
• Assigning the scheme after existing issues have been created; those issues keep the previous scheme unless you bulk‑change their security level.
• Over‑using levels for fine‑grained permissions, which increases maintenance overhead and can slow down searches.