Work item security Enterprise Grid
Work item security lets you hide sensitive work items from people who would otherwise see them through their project access. You do this with an audience: a named list of who can see restricted work items. Attach an audience to a work item type to restrict every work item of that type, or attach it to a single work item to lock only that one.
People outside the audience don't see a restricted work item anywhere in Plane. Plane treats it as if it doesn't exist for them.
How restriction works
An audience is defined at the workspace level and can include three kinds of members:
- Workspace roles: everyone who holds one of the selected workspace roles.
- Project roles: everyone who holds one of the selected project roles. This grants access only in the projects where the person holds that role.
- Specific members: named people, regardless of their role.
When a work item is restricted, these people can see it:
- Workspace Owners and Workspace Admins. They always have access and can't be removed from an audience.
- Anyone who matches at least one of the audiences attached to the work item.
- The work item's assignees and subscribers, even if they aren't in the audience.
Everyone else loses access, even if their project role would normally let them see the work item.
WARNING
Assigning someone to a restricted work item, or adding them as a subscriber, gives them access to it. Check who you add before you assign or subscribe people on sensitive work.
Project Admins don't get automatic access. A Project Admin sees a restricted work item only when the audience includes the Project Admin role or includes them by name.
Type-level and item-level audiences
You can restrict work items at two levels:
- Work item type: every work item of that type is restricted to the type's audiences.
- Individual work item: the work item is restricted to its own audiences.
When a work item has its own audiences, they replace the audiences of its type. The type's audiences no longer apply to that work item. When a work item has no audiences of its own, it follows its type.
When several audiences are attached at the same level, a person needs to match only one of them.
An audience can be created empty. If you attach an empty audience, only Workspace Owners, Workspace Admins, and the work item's own assignees and subscribers can see the restricted work items.
Inactive audiences
An audience is either Active or Inactive. Only active audiences restrict anything. When you disable an audience, every work item type and work item it restricts becomes visible to anyone with normal project access, unless another active audience still restricts them.
If a work item's own audiences are all inactive, the audiences on its work item type apply instead.
Who can do what
| Action | Who can do it |
|---|---|
| View audiences | Workspace Owners, Admins, Members, and Guests |
| Create, edit, enable, disable, and delete audiences | Workspace Owners and Admins, or a custom role granted Create Audiences, Edit Audiences, or Delete Audiences |
| Attach audiences to a workspace work item type | Anyone who can edit workspace work item types |
| Attach audiences to a project work item type | Anyone who can edit that project's work item types |
| Attach audiences to a single work item | Anyone who can edit the work item and view audiences |
The audience permissions appear under Work Item Security in permission schemes: View Audiences, Create Audiences, Edit Audiences, and Delete Audiences. See Permission schemes and Custom roles.
Create an audience
Role: Workspace Owner or Workspace Admin
- Go to Workspace settings > Workspace roles & permission groups.
- Click the Audience tab.
- Click Create audience.
- Enter a Title. The title is required and must be shorter than 100 characters.
- Add an optional Description.
- Click Create.
Plane confirms with Audience created and prompts you to add roles or members.
If the workspace has no audiences yet, the tab shows No audience yet with a prompt to create one.
Choose who is in an audience
Open an audience from the Audience tab. The Configure tab has three sections. Changes save as you make them.
- Under Workspace roles, click Workspace role and select the roles to include. Owner and Admin are always listed and can't be removed.
- Under Project roles, click Project role and select the roles to include.
- Under Specific members, click Member and select people to include, regardless of their role. Only active workspace members can be added.
The Effective audience panel shows the members who currently match the configuration, with a member count and a search box.
See where an audience is used
Open the Usage tab on an audience to see every work item type and work item it's attached to. The Entity column shows whether each row is a Work item type or a Work item. You only see work items in this list that you have access to.
If the audience isn't attached anywhere, the tab shows Not in use yet.
Restrict a work item type
Attach an audience to a work item type to restrict every work item of that type across lists, boards, cycles, modules, dashboards, and pages.
Workspace work item types
Role: Workspace Admin
- Go to Workspace settings > Work item Types and open the type.
- Click the Audience tab.
- Under Restrict work item visibility, click Add audience.
- Select one or more audiences and click Add.
Project work item types
Role: Project Admin
- Open your project's settings and select Work item Types.
- Open a type that was created in the project and click the Audience tab.
- Under Restrict work item visibility, click Add audience.
- Select one or more audiences and click Add.
A workspace work item type imported into a project has no Audience tab in project settings. Its audiences are managed on the workspace type. See Workspace work item types.
Remove an audience from a type
- On the type's Audience tab, click Remove on the audience row.
- Type Confirm and click Remove audience.
Work items of that type become visible to anyone with normal project access, unless another audience on the type still restricts them. Work items with their own audiences stay restricted.
Creating work items of a restricted type
Only people who can see work items of a restricted type can create work items of that type. Other people don't see the type as an option.
Restrict an individual work item
Role: Anyone who can edit the work item
- Open the work item's quick actions menu and select Add audience.
- In the Audience modal, select one or more audiences.
- Click Save changes.
Once restricted, the work item shows a banner that reads Restricted work item. Only people in its audience can see it. In the peek view, a lock icon also appears in the header. If you can edit the work item, click the lock icon or Manage audience on the banner to change its audiences.
If the work item is restricted through its type, the banner reads Restricted by its work item type. Only people in the type's audience can see it. You manage those audiences on the work item type, not on the work item. You can still add audiences to the work item itself, which replaces the type's audiences for that work item.
If no audiences exist yet, the modal shows No audience available. Create one from Workspace roles & schemes.
Remove audiences from a work item
- Click the lock icon or Manage audience.
- Clear the audiences you want to remove and click Save changes.
- Type Confirm and click Remove audience.
If you remove all of the work item's own audiences, it follows its work item type again. If the type has no audiences, the work item becomes visible to anyone with normal project access. Any audiences you keep stay in place.
Disable or delete an audience
Role: Workspace Owner or Workspace Admin
Disable an audience
On the Audience tab, open the audience's menu and select Disable, or turn off the toggle on the audience's page. Confirm in the Disable "audience name"? dialog.
The audience is kept with its configuration and attachments. Select Enable at any time to restore its restrictions.
Delete an audience
- Open the audience's menu and select Delete.
- Type Confirm and click Delete.
Deleting an audience removes it from every work item type and work item it was attached to. Those work items become visible to anyone with normal project access, unless another audience still restricts them. In published projects, they also become visible to anyone with the link. Each affected work item records the removal in its activity.
What restriction affects
For people outside the audience, a restricted work item is left out of:
- Lists, boards, cycles, modules, dashboards, pages, and search.
- Notifications and email notifications. Plane checks access again before it sends an email.
- Attachments. They can't open or upload attachments on the work item.
Other effects:
- Published projects: a work item with any audience attached, active or inactive, doesn't appear in published views for anyone.
- Project subscribers: people who subscribe to a whole project aren't automatically subscribed to restricted work items, because a subscription would give them access.
- Duplicates: when you duplicate a restricted work item, the copy carries the same audiences, so it isn't exposed.
- Activity: adding or removing an audience is recorded in the work item's activity as "added audience" or "removed audience". These changes don't send notifications.