How does Jira Issue Security limit a user's access to a specific issue?

[imthenachoman]

I want to make it so certain users can view and/or comment on specific issues, but not all issues. I was reading that I can use Issue Security for this but I'm not understanding one thing.

My understanding:

1. Enable Issue Security to a project

2. Issue security scheme defined with who can view/comment on issues by specifying Jira groups in the Issue Security settings:

   1. group ABC can view

   2. group DEF can view + comment

3. People get added to those groups

But, what controls the issue they can access?

If Joe is added to group ABC, what says they can view issue 123 BUT NOT issue 456?

[Aaron Brady]

Hello!

Issue security is a handy tool for limiting access to specific issues. As you noted you can use groups to denote who has access to a specific issue, and you can also give access to only the current assignee or the assignee and reporter.

You can specify when to apply the issue security scheme and what level of access to apply by clicking on the lock icon. 

This article may also help: configuring issue level security 

-Aaron

[Mikael Sandberg]

Issue security works in conjunction with the permission scheme. The issue security defines who have access to the issue based on your role, group, single user, etc. My recommendation is to use roles instead of groups, because that allows you to control the access from within the project instead of having to add and remove users from groups from the admin side.

Once you have defined your issue security and permission scheme the access to individual issues is controlled by the field security level. Example: you have two security levels, External and Internal. If group ABC has access to External but not Internal and Joe belongs to that group, he would have access to all issues that have the External security level, but not to Internal. 

[imthenachoman]

But how do we say that Joe can see Issue 1, and Sue can see Issue 2.