Issue Summary

When an account leverages an external, incoming, application link in Jira there are two layers of permission controls that affect integrations:

• The first layer of security is scope verification at the endpoint level. This mechanism is consistent across all Atlassian products.
• The second layer of security is Jira’s permission system, which defines how access is granted to projects, issues, and other resources.

Therefore, if the token scope is, for example, system_admin but the consenting user does not have mirroring permissions, then the scope of the user is limited to the permission scheme that they are associated to.

The consenting user should be able to mirror the permissions at the endpoint level instead of being restricted by Jira's permission system.

Steps to Reproduce

1. Create an External, Incoming, Application Link in Jira with system_admin permissions
2. Create an Access Token by following the Oauth2 authorization process
3. When confirming consent, chose a non-administrator account
4. After the token is generated, try to perform an admin function, or function that requires key permissions like "manage sprints"

Expected Results

As the oauth2 token has elevated permissions, then the access token should grant users the same level of ability in Jira

Actual Results

The user is unable to complete tasks that they would not typically have access to do via the GUI

Workaround

Setup a secure account with mirroring permissions and use that for your external integration