Roles and permissions

Verified Users and explicit ProjectMemberships control every project record, query, comment and attachment. Reporter-visible content is separate from internal discussion. QA and other workflow decisions require an independent authorized actor; Admin configuration cannot bypass the protected decision.

Permissions

Summarised from the authored role permissions. Scope restrictions such as “own records” still apply; these symbols do not indicate completeness or runtime access.

TableProject Lead / Product OwnerScrum Master / Iteration ManagerDeveloper / EngineerStakeholderReporterQA / Tester
transaction
IssuesNo table-specific permission stated Specific actions: Update Issues.Sprint (pull-from-Backlog into Sprint, push-back-to-Backlog mid-sprint with audit)No table-specific permission statedNo table-specific permission stated Specific actions: Create Issues with Type constrained to Bug / Task / Improvement / Incident (no Story / Epic / SubTask creation)No table-specific permission stated
line item
WorkflowTransitions Specific actions: Approve transitions in WorkflowTransitions configured with RequiredApproverRole = ProjectLeadNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Specific actions: Approve transitions in WorkflowTransitions configured with RequiredApproverRole = QA (typically the bug-verification gate InReview → Done for IssueType = Bug)
  • Scrum Master / Iteration ManagerTrigger velocity-recompute and sprint-end-rollover manually
  • Developer / EngineerStatus transitions are gated by the Issue's Workflow — Developer may request permitted transitionsNone needs no extra reviewer, while Any or a named gate requires a separate eligible independent decision on the current revisionHolding the named role never permits self-approvalpeers' Hours masked
  • StakeholderNo write access anywherecannot post Comments
  • ReporterRead only ReporterVisible comments and attachmentsCreate or edit their own ReporterVisible comments and attachments on those permitted issuesnever change Internal content or widen audienceCannot transition Status (the team owns the lifecycle)
Manage / maintain View Specific actions— No table-specific permission statedPermissions also apply to agents

The roles

Project Lead / Product Owner

Owns the Project end-to-end — backlog priority, release planning, estimate overrides, scope decisions. The DRI for the product the Project ships.

Permissions and screens
  • CRUD on Projects (own), Components (own Project), Backlogs (own), Versions (own), Epics (own), Milestones (own)
  • CRUD on Issues (own Project) including estimate / priority / fix-version overrides
  • Assign / re-rank Issues.BacklogRank
  • Plan Sprints (create Future Sprints, populate scope before sprint-start)
  • Approve transitions in WorkflowTransitions configured with RequiredApproverRole = ProjectLead
  • Read all Boards, Sprints, SprintCommitments, IssueWorkLog (rolled-up
  • not per-person beyond own team), TeamVelocity, Burndowns, EpicProgress for own Project
  • Cannot edit Workflows or IssueTypes (Admin)
Stalled IssuesInProgress
Issue KeyProjectTitleAssignee
Open PR ActivityOpen
Issue Issue KeyIssue TitleProviderRepo
Git Lab
Sprint CalendarFuture
Sprint NumberProjectGoalStart Date
Scrum Master / Iteration Manager

Runs the Sprint cadence and the Board. Owns ceremonies (planning, standup, review, retro), WIP discipline, and the burndown.

Permissions and screens
  • CRUD on Sprints (own Project) including Status: Future → Active → Closed transitions
  • CRUD on Boards (own Project) and BoardColumns configuration
  • CRUD on WipLimits (with Reason audit)
  • Read on Issues, SprintCommitments, Burndowns, TeamVelocity
  • CRUD on IssueLinks for blocker management
  • Update Issues.Sprint (pull-from-Backlog into Sprint, push-back-to-Backlog mid-sprint with audit)
  • Trigger velocity-recompute and sprint-end-rollover manually
  • Field-masked aggregate view of team IssueWorkLog.Hours
Stalled IssuesInProgress
Issue KeyProjectTitleAssignee
Open PR ActivityOpen
Issue Issue KeyIssue TitleProviderRepo
Git Lab
Sprint CalendarFuture
Sprint NumberProjectGoalStart Date
Developer / Engineer

Delivery contributor. Works assigned Issues, transitions Status, logs work, comments, attaches files, opens PRs that auto-link back.

Permissions and screens
  • Read on Projects where active ProjectMemberships grants their Developer role, and the Project's Components, Boards, Sprints, SprintCommitments, Backlogs, Versions, Epics, Milestones, EpicProgress
  • CRUD on Issues where Issues.Assignee = self OR Issues.Reporter = self (limited to allowed WorkflowTransitions)
  • Status transitions are gated by the Issue's Workflow — Developer may request permitted transitions
  • None needs no extra reviewer, while Any or a named gate requires a separate eligible independent decision on the current revision
  • Holding the named role never permits self-approval
  • CRUD on own IssueComments, IssueAttachments, IssueWorkLog (own rows only)
  • Read own IssueWorkLog.Hours
  • peers' Hours masked
Open PR ActivityOpen
Issue Issue KeyIssue TitleProviderRepo
Git Lab
Sprint CalendarFuture
Sprint NumberProjectGoalStart Date
My Open Issues
Issue KeyProjectTitleIssue Type
Stakeholder

Read-only audience for an assigned Project — executive sponsor, adjacent team lead, internal customer. Sees the board and the roadmap but cannot change anything.

Permissions and screens
  • Read on Projects, Components, Boards, Sprints, SprintCommitments, Issues (with IssueWorkLog.Hours masked), IssueComments, IssueLinks, Versions, Epics, EpicProgress, Milestones, Burndowns, TeamVelocity only where they are explicitly assigned via the ProjectMemberships with Role = Stakeholder
  • Read the Roadmap and Release Forecast views scoped to assigned Projects
  • No write access anywhere
  • cannot file Issues (Reporter does that)
  • cannot post Comments
Active Sprint BoardActive
Issue KeyTitleAssigneePriority
Low
Velocity TrendClosed
SprintCommitted PointsCompleted PointsCarryover
Epic Progress
EpicEpic OwnerEpic StatusEpic Target Version
Closed
Reporter

Internal user outside the squad who needs to file Issues — IT help requesters, internal customers of an API team, stakeholders who hit a bug. Can create Issues and comment on own Issues; sees nothing else.

Permissions and screens
  • Create Issues with Type constrained to Bug / Task / Improvement / Incident (no Story / Epic / SubTask creation)
  • Read own filed Issues (Issues.Reporter = self) only while active ProjectMemberships grants Reporter access to that project, including permitted Status, Resolution and Assignee
  • Read only ReporterVisible comments and attachments
  • Create or edit their own ReporterVisible comments and attachments on those permitted issues
  • never change Internal content or widen audience
  • Cannot transition Status (the team owns the lifecycle)
  • cannot read other Reporters' Issues
  • cannot read Boards, Sprints, Backlogs, IssueWorkLog, or any roll-up
My Reported Issues
Issue KeyProjectTitleIssue Type
QA / Tester

Quality role. Files and verifies bug Issues, transitions Issues through the verification gate, signs off on InReview → Done for Bug-type Issues.

Permissions and screens
  • CRUD on Issues (own Project) with IssueType favored to Bug, Task, Incident
  • Approve transitions in WorkflowTransitions configured with RequiredApproverRole = QA (typically the bug-verification gate InReview → Done for IssueType = Bug)
  • CRUD on own IssueComments, IssueAttachments, IssueLinks for Duplicates / Relates linking
  • Read on Sprints, SprintCommitments, Boards, Versions (test-target version), Burndowns for own Project
  • Cannot edit Workflows, Boards, BoardColumns, WipLimits
  • cannot re-rank Backlogs
  • cannot release a Versions
Bugs Awaiting VerificationBug
Issue KeyProjectTitleSeverity
Sev2
Transition Review InboxPending
Approval NumberIssueTransitionRequested By
My Open Issues
Issue KeyProjectTitleIssue Type

How permissions work

Verified Users and explicit ProjectMemberships control every project record, query, comment and attachment. Reporter-visible content is separate from internal discussion. QA and other workflow decisions require an independent authorized actor; Admin configuration cannot bypass the protected decision.

ERP•AI workspace

Start now PM for IT Projects

Create your ERP.AI account and get started with Proto.

Start now Download agent

Customize PM for IT Projects. With Proto, your desktop AI agent.

Ask Proto to help you customize PM for IT Projects.

Customize
PM for IT Projects. Ask: “Adapt Projects and backlog.” ProtoYour desktop AI agent
Download nowFree install · ~1 GB · AI usage extra