Verified Users and explicit project memberships control every project record, query, comment and attachment. Reporter-visible content is separate from internal discussion. QA and other workflow decisions require an independent authorized actor; Admin configuration cannot bypass the protected decision.
Systems administrator. Owns configuration, integration plumbing, and the issue types / Workflows / Boards templates that every Project pulls from. Not the day-to-day operator.
Can
Manage technical configuration and identity
Business approvals and immutable historical records remain guarded
Manage RBAC and role assignments
Configure issue types, Workflows, workflow statuses, workflow transitions, default Boards templates, and the Git provider / Slack / Teams / email integrations
Co-sign on Workflow changes affecting Projects with active Sprints
Can't
Retire an issue types row with outstanding Issues
Delete a Closed Sprint or a Released Version
Project Lead / Product Owner
Owns the Project end-to-end — backlog priority, release planning, estimate overrides, scope decisions. The DRI for the product the Project ships.
CRUD on Issues (own Project) including estimate / priority / fix-version overrides
Assign / re-rank issue backlog rank
Plan Sprints (create Future Sprints, populate scope before sprint-start)
Read all Boards, Sprints, sprint commitments, issue work log (rolled-up; not per-person beyond own team), team velocity, Burndowns, epic progress for own Project
Reviews and approves
Approve transitions in workflow transitions configured with required approver role = project lead
Can't
Edit Workflows or issue types (Admin)
Retroactively edit a frozen sprint commitments row
Starts on: Stalled Issues
Scrum Master / Iteration Manager
Runs the Sprint cadence and the Board. Owns ceremonies (planning, standup, review, retro), WIP discipline, and the burndown.
Can
CRUD on Sprints (own Project) including Status: Future → Active → Closed transitions
CRUD on Boards (own Project) and board columns configuration
CRUD on wip limits (with Reason audit)
Read on Issues, sprint commitments, Burndowns, team velocity
CRUD on issue links for blocker management
Update issue sprint (pull-from-Backlog into Sprint, push-back-to-Backlog mid-sprint with audit)
Trigger velocity-recompute and sprint-end-rollover manually
Field-masked aggregate view of team issue work log hours
Can't
Approve project lead-gated transitions
Edit Versions
Post manual issue history entries
Starts on: Stalled Issues
Developer / Engineer
Delivery contributor. Works assigned Issues, transitions Status, logs work, comments, attaches files, opens PRs that auto-link back.
Can
Read on Projects where active project memberships grants their Developer role, and the Project’s Components, Boards, Sprints, sprint commitments, Backlogs, Versions, Epics, Milestones, epic progress
CRUD on Issues where issue assignee = self OR issue reporter = self (limited to allowed workflow transitions)
Status transitions are gated by the Issue’s Workflow — Developer may request permitted transitions
None needs no extra reviewer, while Any or a named gate requires a separate eligible independent decision on the current revision
Holding the named role never permits self-approval
CRUD on own issue comments, issue attachments, issue work log (own rows only)
Read own issue work log hours
peers’ Hours masked
CRUD on issue links (limited link types: Blocks / is blocked by / Duplicates / Relates)
Can't
Edit Workflows, issue types, Boards, board columns, wip limits, Sprints headers, Versions, or other users’ work-log rows
Bypass WIP limits
Starts on: Open PR Activity
Stakeholder
Read-only audience for an assigned Project — executive sponsor, adjacent team lead, internal customer. Sees the board and the roadmap but cannot change anything.
Can
Read on Projects, Components, Boards, Sprints, sprint commitments, Issues (with issue work log hours masked), issue comments, issue links, Versions, Epics, epic progress, Milestones, Burndowns, team velocity only where they are explicitly assigned via the project memberships with Role = Stakeholder
Read the Roadmap and Release Forecast views scoped to assigned Projects
No write access anywhere
Can't
File Issues (Reporter does that)
Post Comments
Starts on: Active Sprint Board
Reporter
Internal user outside the squad who needs to file Issues — IT help requesters, internal customers of an API team, stakeholders who hit a bug. Can create Issues and comment on own Issues; sees nothing else.
Can
Create Issues with Type constrained to Bug / Task / Improvement / Incident (no Story / Epic / subtask creation)
Read own filed Issues (issue reporter = self) only while active project memberships grants Reporter access to that project, including permitted Status, Resolution and Assignee
Read only reporter visible comments and attachments
Create or edit their own reporter visible comments and attachments on those permitted issues
never change Internal content or widen audience
Can't
Transition Status (the team owns the lifecycle)
Read other Reporters’ Issues
Read Boards, Sprints, Backlogs, issue work log, or any roll-up
Starts on: My Reported Issues
QA / Tester
Quality role. Files and verifies bug Issues, transitions Issues through the verification gate, signs off on in review → Done for Bug-type Issues.
Can
CRUD on Issues (own Project) with issue type favored to Bug, Task, Incident
CRUD on own issue comments, issue attachments, issue links for Duplicates / Relates linking
Read on Sprints, sprint commitments, Boards, Versions (test-target version), Burndowns for own Project
Reviews and approves
Approve transitions in workflow transitions configured with required approver role = QA (typically the bug-verification gate in review → Done for issue type = Bug)
Can't
Edit Workflows, Boards, board columns, wip limits
Re-rank Backlogs
Release a Versions
Starts on: Bugs Awaiting Verification
Set up IT Projects PM your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.
We use essential cookies to run the site and optional cookies for features, analytics, and relevant content.
See Cookie policy
Manage Your Cookie Preferences
We use cookies to enhance your experience, analyze site traffic, and serve relevant content.
By clicking "Accept All," you agree to our use of cookies. You can customize your
preferences at any time.
Your browser's Global Privacy Control signal is honored: advertising cookies are off.
These cookies are required for the website to function properly. They ensure security,
enable basic features like page navigation, and store user session data. You cannot
disable these cookies.
These cookies enable additional features that enhance your experience, such as live chat,
video playback, personalized content recommendations, and remembering user preferences.
These cookies help us understand how visitors interact with our site by collecting
anonymous usage data. This allows us to measure performance, detect issues, and
continuously improve the user experience.
These cookies allow us and advertising partners, including X, to deliver ads tailored to
your interests. They track browsing habits across sites to provide relevant advertising
and measure ad effectiveness.