Permissions and access
Who can do what in the app, and which Jira permissions the app itself asks for.
Who can do what#
The app has no roles of its own. Anyone who can open the app can see and change every record in it: there is no private lead, deal or contact. Treat access to the app as access to your whole customer list.
| Action | Any user of the app | Jira administrator |
|---|---|---|
| View records, reports and the audit trail | Yes | Yes |
| Create, edit, delete and merge records | Yes | Yes |
| Import, export, bulk actions | Yes | Yes |
| Save your own views | Yes | Yes |
| Change Settings (currency, stale threshold, deal stages, custom fields) | No | Yes |
| Load Sample Data, Delete All Data | No | Yes |
Owner and assignee are labels that say who is responsible. They do not restrict who can edit the record.
Who can open the app at all is controlled by Jira: the Apps menu entry is available to people who can use Jira on the site.
What the app asks of Jira#
Installing the app asks a Jira administrator to approve five permissions:
| Permission | What it is used for |
|---|---|
storage:app | The app's own storage, where your records are kept. |
read:jira-work | Checking that a work item key you type exists and showing its summary and status. |
write:jira-work | Writing the app's own read-only CRM fields on linked work items, and nothing else. |
read:jira-user | Showing people's names and searching for people in the owner and assignee pickers. |
report:personal-data | Reporting the Atlassian account ids it holds, so that it can remove closed accounts. See the privacy policy. |
The app never creates, transitions or comments on a work item. Every Jira lookup is made as the signed-in user, so it sees only what that person can see. The one exception is writing the app's own CRM fields, which Jira lets only the app itself do.
Automation steps run as the person on the rule's connection, with that person's Jira permissions for checking the work item.