-
Type:
Suggestion
-
Resolution: Unresolved
-
Component/s: Request type - Permissions & Security
-
None
-
2
-
1
Issue Summary
When an agent attempts to move a JSM issue to another project, the Move Issue dialog requires Browse Projects permission on the destination project to display its Request Types. However, the JSM Customer Portal already exposes Request Types to customers without Browse Projects — creating a least-privilege inconsistency for agents.
Steps to Reproduce
- Create two JSM projects — Project A (source) and Project B (destination).
- Create an agent role on Project B with Create Issues permission only — do not grant Browse Projects.
- Log in as an agent who has access to Project A but only Create Issues on Project B.
- Open an issue in Project A and select Move Issue.
- In the Move dialog, attempt to select Project B as the destination.
Expected Results
The agent can see and select Project B's Request Types in the Move Issue dialog, consistent with how the JSM Customer Portal exposes Request Types to customers who also lack Browse Projects permission. A narrower permission (e.g., Create Issues or a future "View Projects" scope) should be sufficient to enumerate Request Types during a Move operation.
Actual Results
Project B's Request Types are not visible in the Move Issue dialog. The agent cannot complete the Move unless Browse Projects is explicitly granted on Project B.
Workaround
- Grant Browse Projects + Issue Security Scheme on Project B (administrative overhead, violates least privilege).
- Use a Jira Automation rule triggered by a custom field to perform the move on the agent's behalf (inflexible, requires per-destination maintenance).