Docs / Reference
Permissions and access
Who can do what in the app, and which Jira permissions the app itself asks for.
Who can do what#
Access is decided per project. See Sharing and ownership for how people are given a level.
| Action | Viewer | Editor | Owner | Site admin |
|---|---|---|---|---|
| Open a project and read its figures | Yes | Yes | Yes | Yes, even if not shared with them |
| Change settings, rates, team, expenses, revenue, budget, milestones | No | Yes | Yes | Yes, as owner |
| Change sharing, transfer ownership, delete the project | No | No | Yes | Yes, as owner |
| Create a project | Anyone using the app; the creator becomes its owner. | |||
| Action | Viewer | Owner |
|---|---|---|
| Open it and read its figures | Yes | Yes |
| Add or remove projects, edit the description, share it, delete it | No | Yes |
| Resource | See it | Create, edit, delete |
|---|---|---|
| Cost accounts | Everyone | Jira site administrators |
| Attributes | Everyone | Jira site administrators |
| Role library | Everyone | Jira site administrators |
| Reports | A report's data is limited by the project it reads: you only see figures for projects you can open. | |
Hourly rates are tied to named people and can reveal compensation-related information. Who sees a project's rates is controlled by that project's sharing settings, and nothing in the app shows one project's rates to someone without access to it.
Permissions the app asks for#
The app requests three Forge permissions and nothing else:
| Permission | Used for |
|---|---|
| read:jira-work | Searching issues and reading their worklogs and dates, listing Jira projects, and checking whether you are a site administrator. |
| read:jira-user | Showing people's names and finding users to add as members or to share with. |
| storage:app | Keeping the app's own data (projects, rates, expenses) in Forge storage. |
Jira is only ever read, never written to. Requests to Jira run as the person using the app. Cost Tracker declares no external network access and no web triggers. Details: Privacy policy and Security policy.
Cost Tracker is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. Questions or corrections: info@vudia.site.