Work item security for sensitive work

Some work needs more restricted access, even within a shared project.

Introducing Work item security, which lets you control who can see sensitive work items using Audiences. Restrict an individual work item or apply the same access rules to an entire Work item type, while keeping the work in its existing project.

Define access with Audiences

An Audience is a reusable group that determines who can view restricted work items. Create audiences at the workspace level using:

• Workspace roles
  Include members based on their workspace permissions.
• Project roles
  Include members based on their roles within a project.
• Specific members
  Grant access to individuals, regardless of their role.

You can combine these criteria within an audience and review its effective membership before applying it.

Workspace owners and admins always retain access to restricted work items. Work item assignees and subscribers also retain access, even when they aren't included in the selected audience.

Restrict individual work items

Apply an Audience to a specific work item when its contents should be visible only to selected people.

For example, a project may contain a confidential budget approval that requires review by Finance and leadership. Apply the appropriate Audience to keep that work item restricted without moving it into a separate private project.

Apply security to entire Work item types

For categories of work that regularly contain sensitive information, apply Audiences at the Work item type level.

For example, create a Security Incident Work item type and assign a Security Audience to it. Every work item of that type follows the configured visibility restrictions.

Multiple Audiences can be attached at either level. Anyone matching at least one active Audience at the applicable level can access the item.

Keep restricted work visible only to authorized people

Restricted work items are excluded from the surfaces available to people without access, including:

• Project lists, boards, cycles, and modules.
• Dashboards, Pages, and search results.
• Notifications and emails associated with the restricted work item.
• Direct access to the work item's contents and attachments.

Authorized members see an indicator on restricted work items, making it clear that their visibility differs from other items in the project.

Audiences control visibility. Existing workspace and project permissions continue to determine what authorized members can do with the work item.

Availability

Work item security is available on Plane Cloud on Enterprise Grid.