Set Issue, Comment, and Attachment Visibility

Permission-based Visibility

The first level of visibility is set at the project level. The Read Issue permission is granted on a per-project basis. Only users and members of groups who are granted this permission in a project are able to view the issues that are assigned to this project.

The Read Comment permission works the same way. You can have users and groups that can view issues in the project, but cannot see any of the comments.

There are other permissions that limit who can view various issue attributes, like voters, watchers, work items, and private fields.

The project administrator restricts the visibility of issues, comments, and issue attributes by selecting which users and groups are granted roles that contains these permissions. For more information about project settings, see Manage the Project Team.

Issue Visibility

The second level of visibility is defined in the issue itself. You can restrict read access for an issue within the scope that is set at the project level. Issue-level visibility settings cannot override the access permissions that are defined for the project, but can limit the visibility to a smaller subset of users.

For example, if groups A and B are granted roles that let them read issues in a project, you can restrict the visibility of an issue to group A or group B, or to users who are members of either group. While it is possible set the visibility of an issue to another group, for example, group C, the members of this group do not have access permissions in the project and cannot view the issue.

Issues with visibility restrictions display a padlock icon. This icon is visible in the header in full page view and in view mode on an agile board. These icons are also visible in all views on the Issues list. Move the pointer over this icon to display the full list of users and groups for whom the issue is visible.

Issues are always visible to the user who reported the issue. If the visibility for an issue is restricted to set of users that excludes the reporter, the name of the reporter is added to the list automatically. This condition is shown explicitly for issues on an agile board. In full page view and the Issues list, the reporter is not shown separately in the Visible to list.

To set the visibility of a new issue in full page view:

1. In the issue draft, click the Visible to drop-down list. This option appears directly above the Create issue button.

   

2. Select one or more users and groups from the drop-down list. Keep in mind that this list only shows users and groups that have access to projects that you also have permission to access.

   • Use the input field to filter the list.

3. Click the Apply button in the drop-down list.

4. Click the Create Issue button.

   • The issue is created and is only visible to the selected users and groups.

To set the visibility of a new issue on an agile board:

1. In the issue draft, click the Visible to drop-down list. This option appears directly above the Add card button.

   

2. Select one or more users and groups from the drop-down list. Keep in mind that this list only shows users and groups that have access to projects that you also have permission to access.

   • Use the input field to filter the list.

   • Remove single users or groups from the list with the Remove option.

   • Clear the current selection with the Reset visibility option.

3. Click away from the drop-down list or press Esc.

4. Click the Add card button.

   • The issue is created and is only visible to the selected users and groups.

To change the visibility of an existing issue in full page view:

1. Open the issue in full page view and click the Visible to drop-down list.

   

2. Select or deselect users or groups from the drop-down list. To remove visibility restrictions, deselect all of the users and groups in the list. Keep in mind that this list only shows users and groups that have access to projects that you also have permission to access.

3. Click the Apply button.

   • The visibility of the issue is updated to restrict access to the selected users and groups.

To change the visibility of an existing issue on an agile board:

1. Open the card in view mode and click the Visible to drop-down list.

   

2. Select or deselect users or groups from the drop-down list. To remove visibility restrictions, click the Reset visibility option. Keep in mind that this list only shows users and groups that have access to projects that you also have permission to access.

3. Click the Apply button.

   • The visibility of the issue is updated to restrict access to the selected users and groups.

Visibility for Comments

The third level of visibility is defined for each comment that is added to an issue. Comments inherit the visibility setting from the issue. That is, if an issue is visible to group A only, users from other groups cannot read the comment, even if the comment is visible to the All Users group. This is because the visibility of the issue itself is restricted to group A.

When you restrict the visibility of an issue, the default visibility setting for new comments is set to Same as issue.

You can restrict the visibility of a comment to a subset of the users for whom the issue is visible. For example, if the issue is visible to All Users, you can restrict the visibility of a comment to group A or any members of the All Users group.

There are two versions of the controls that you use to set or change the visibility of a comment.

• The first type is visible when you add comments in the Issues list, in full page view, and in the Apply Command dialog when you apply commands in either of these locations.

  

  To set the visibility for a comment with this control, select users and groups from the Visible to drop-down list, then click the Apply button.

• The second type is visible when you add comments to issues on an agile board or when you apply a command from the board.

  

  With this control, you only need to select or deselect users and groups. The selection is applied automatically.

Keep in mind that if you set the visibility for a comment to a user or group for which the issue itself is not visible, the user and members of this group still cannot read the comment.

Visibility for Attachments

You can further restrict the visibility of files that are added to issues as attachments. When you attach a file to an issue or comment, use the Attach File Privately option.

• Files that are attached to comments or images that are pasted into comments inherit the visibility that is set for the comment itself.

• You can still set the visibility of an attachment to be different from the comment.

• You can change the visibility of an attachment in the Edit Attachment dialog.

Again, there are two versions of the controls that you use to set or change the visibility of an attachment.

• The first type is visible when you attach files in the Issues list and in full page view with the Attach File Privately option. When you select this option on these pages, you can only restrict the visibility to one or more groups. However, you can update the visibility to select multiple users in the Edit Attachment dialog.

  

  To set the visibility for attachments with this control, select one or more groups from the Visible to drop-down list, then click the Apply button.

• The second type is visible when you attach files to issues on an agile board with the Attach File Privately option.

  

  Here, you can select multiple users and groups. The selection is applied automatically.

Keep in mind that if you set the visibility for an attachment to a user or group for which the issue is not visible, the user and members of this group still cannot see the attachment.

Overriding Visibility Restrictions

You can grant privileged users permission to view any issue, comment, or attachment regardless of its visibility settings. The Override Visibility Restrictions permission was first introduced in YouTrack 20172.3 and was granted automatically to users who already had either the Low-level Read Administration or the Low-level Administration permission.

This permission ensures that users who require a high level of access in a project can still view information that has been severely restricted, for example, to a single user.