Access (Permission)

Access is the mechanism for granting users, groups, and service accounts rights to a space (Workflow) .

When a space is created, access to it is granted to the space owner and the system administrator. To involve other participants, the owner or a user with access-management rights adds them in the space settings.

Access through Permission applies to the entire space. The access model at the level of individual ticket types is no longer used.

Where it is applied

Permission determines what a user can do inside a space:

• see the space and tickets;
• create tickets in an available space;
• read, comment on, or change tickets depending on the access level;
• manage space settings and participants if the maximum level is granted.

If access is needed only to one specific ticket, a separate model is used: Ticket access (TicketPermission) .

Access subjects

Access can be assigned to one of the subject types:

• USER — user;
• GROUP — user group;
• SERVICE_ACCOUNT — service account for integrations and system clients.

A single access record must specify exactly one subject: a user, a group, or a service account.

Access levels

RO

Read-only access.

The user can see the space and related tickets, but cannot change tickets, leave comments, or manage settings.

COMMENT

Read and comment access.

The user can view tickets and take part in discussion, but cannot change ticket fields.

RW

Read and change access for tickets.

The user can work with tickets in the space: read, comment, and change ticket data. This level does not grant the right to manage space settings or grant access to other users.

OWNER

Full access to the space.

The user can work with tickets, manage space settings, and grant access to other participants.

Attributes

Space (workflow)

Workflow

The space to which access is granted.

User (user)

User

The user to whom access is granted. Used with the USER subject type.

User group (group)

Group

The group whose members receive access. Used with the GROUP subject type.

Service account (serviceAccountId)

String

Service account identifier. Used with the SERVICE_ACCOUNT subject type.

For a Keycloak client with Service Accounts Roles enabled, the following value is typically used:

service-account-<client-id>

For example, if the following client is created:

credit

then the access record specifies:

service-account-credit

Difference from ticket access

Permission works at the space level and affects all tickets in that space.

TicketPermission works only at the level of one specific ticket. It does not open the entire space, does not grant access to settings, and does not apply to other tickets in the same space.

Examples

User with RO

The user sees the space and tickets, but cannot change ticket fields or write comments.

User with COMMENT

The user sees tickets and can leave comments, but cannot edit the ticket.

User with RW

The user can change tickets in the space, but cannot manage access or space settings.

User with OWNER

The user can work with tickets, change space settings, and manage participant access.