Permissions
Residual has no permission settings of its own. It uses the permissions of your Jira project, so the project’s permission scheme stays the single source of truth.
| Level | Jira project permission | What it allows in Residual |
|---|---|---|
| View | Browse projects | See the register, the heatmap, risk details, treatments and history. Export PDF and CSV. |
| Edit | Edit issues | Create and edit risks, assess inherent and residual risk, add and change treatments. |
| Admin | Administer projects | Configure the register for the project and delete risks. |
How the check works
Section titled “How the check works”Every request to the app checks the permissions of the signed in user in the project. The check runs as that user (asUser), against Jira’s own permission scheme. If a permission is missing, the app refuses the action, even if a button was visible.
No Jira administrator needed
Section titled “No Jira administrator needed”Configuring the register requires Administer projects, which project admins have. Residual never asks for Jira administrator rights and never changes the permission scheme.
Deleting risks
Section titled “Deleting risks”Only project admins can delete a risk. The deletion is recorded in the audit trail, and the audit events of the deleted risk are kept. See Audit trail.