Permissions & Access
Role Model Overview
Access is controlled by a granular, permission-based RBAC system - not a single admin/member toggle. There are three layers:
| Layer | What It Is | How Assigned |
|---|---|---|
| Jira Admin | Full access to every module and every Settings screen | Automatic - detected from the Jira site ADMINISTER permission, or membership in the org-admins group or a jira-admins-* group |
| Built-in Team Roles | Team Member, Team Lead, Program Manager, Rate Administrator | Auto-derived from team/program structure - whoever is set as a team's Lead or a program's Manager holds that role automatically for that team/program |
| Custom Permission Roles | Admin-defined roles built from a catalog of granular permissions, scoped globally, to a program, or to specific teams | Manually assigned by an admin via Settings → Data Access → Permission Roles |
There is no single "Member" role and no blanket read-only default anymore. Access is evaluated per permission and per scope (global, project, or team) - a user can hold different effective access in different teams.
Permission Scopes
| Scope | Covers | Source |
|---|---|---|
| Global | App-wide capabilities: App Administrator, Account Administrator, Team Administrator, Rate Administrator, Billing Period Manager, Space Configuration Admin | Assigned to individual users or Jira groups |
| Project | 10 read-only permissions mirroring Jira's own project permission scheme | Sourced live from Jira - not configured inside the app |
| Team | 11 permissions covering worklogs, plans, and timesheet approval (e.g. team.view_worklogs, team.manage_worklogs, team.approve_timesheets) | Held via a built-in team role or a custom Permission Role scoped to that team |
Some team permissions cascade - holding team.approve_timesheets, for example, automatically grants team.view_worklogs, team.view_plans, and team.approve_plans as well.
How to Open the App
- Log in to your Jira Cloud site
- Click Apps in the top navigation bar
- Select "Time Tracking, Resource Planning & Project Management"
How to Check or Manage Permissions
Go to Settings → Data Access. This area is only visible to Jira admins and users holding a global role assignment - there is no separate self-service "My Permissions" screen. It has three tabs:
| Tab | Purpose |
|---|---|
| Permission Overview | See who holds which global permissions and roles |
| Permission Roles | Create and assign custom roles - pick a permission set, then scope it globally, to a program, or to specific teams; each role is Full access or Restricted to chosen teams |
| Audit Log | History of permission and role changes |
How Jira Admin Access Works
Jira Admin status is automatically detected, not assigned inside the app. A user is treated as a Jira Admin if any of the following is true:
-
They have the Jira site-level ADMINISTER permission
-
They belong to the
org-adminsJira group -
They belong to a
jira-admins-*Jira group (site-specific naming) -
To grant Jira Admin access: add the user to a qualifying Jira group, or give them the Jira ADMINISTER permission
-
To revoke it: remove them from the qualifying group(s)
-
The app re-evaluates this on the user's next action - no manual sync needed
How to Request Access
If features are greyed out or unavailable:
- Ask your Jira admin or app manager what access you need for the module in question
- Ask them to make you a Team Lead/Program Manager on the relevant team, or assign you a custom Permission Role via Settings → Data Access → Permission Roles
There is no self-service role request form - access is granted by whoever holds the relevant admin permission.