**As** a user
**I want to** understand, easily administrate and flexibly grant permissions to create and change workspaces (project, program & portfolio)
**so that** the permissions are granted correctly and as restricted as possible without Begin of the insertionwrongfullyEnd of the insertion interrupting work.

**Context:**

There are currently a number of permissions already in place:

* create project (global)

* copy projects

* create subprojects


Limitations on the current structure is discussed in <mention class="mention" data-id="60623" data-type="work_package" data-text="#60623">#60623</mention> . #63544 suggests to add the global permissions &quot;Manage project hierarchies&quot; and &quot;Create project hierarchies&quot; and turn &quot;Copy projects&quot; into a global permission.

The two WPs mentioned above where created before programs and portfolios where thought about. &nbsp;

**Acceptance criteria**

The following table lists Begin of the insertionthe permissions that are either added or already exist

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Permission</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Global</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Previous permission, changed or added</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Explanation</strong></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Create projects</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Existed before (unchanged)</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows the creation of workspace of the type "project"</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Create programs</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows the creation of workspace of the type "program"</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Create portfolio</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows the creation of workspace of the type "portfolio"</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Manage children</p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p">Replaces "Create subprojects<strong>"</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p">The permission allows selecting a child workspace to the workspace the permission is granted in. It no longer allows the creation of new workspaces.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Copy workspace</p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p">Replaces "Copy projects<strong>"</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p">Users will need any of "Create projects", "Create programs" or "Create portfolio" to actually copy a workspace. That way, the creation of projects is more tightly controlled. On the other hand, this might be complicated for users to understand.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Copy project templates</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows copying project templates. Adding this permission separately, on top of "Create projects" allows to better supportEnd of the insertion use cases Begin of the insertionwhere all projects should be based on a template.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Copy program templates</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows copying program templates. Adding this permission separately, on top of "Create programs" allows to better support use cases where all programs should be based on a template.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Copy portfolio templates</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows copying portfolio templates. Adding this permission separately, on top of "Create portfolios" allows to better support use cases where all portfolios should be based on a template.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Manage templates</p></td><td class="op-uc-table--cell"><p class="op-uc-p">✅&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Added</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Allows turning a workspace into a templateEnd of the insertion and Begin of the insertionremovingEnd of the insertion Begin of the deletion suggestsEnd of the deletion the Begin of the insertionworkspace from the set of templates.</p><p class="op-uc-p">Potentially, this also needs to be separated into three different permissions, one per workspace type.</p><p class="op-uc-p">Adding this permission might be out of scope as it is not strictlyEnd of the insertion necessary Begin of the insertionfor the epic.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Edit workspace</p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p">"Edit project" permission is renamed and changed&nbsp;</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Looses ability to manage parent</p></td></tr></tbody></table></figure>End of the insertion Begin of the deletion permissions:End of the deletion

Begin of the insertionThe following table lists use cases and  the necessary permissions for them. Sometimes, global and workspace permissions are required at the same time:

End of the insertion <figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table" style="border-color:#dfddd0;border-style:solid;"><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><strong>Use case</strong></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><strong>Required global permissions</strong></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><strong>Required project permissions</strong></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><strong>Remarks</strong></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Add a project (without hierarchy)</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Create projects</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Add a program (without hierarchy)</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Create Begin of the insertionprograms</p></td><tdEnd of the insertion Begin of the deletion program&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Add a portfolio (without hierarchy</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Create Begin of the insertionportfolios</p></td><tdEnd of the insertion Begin of the deletion portfolio&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Turn a workspace (e.g project) into a child of another workspace (e.g. portfolio)&nbsp;</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">"Manage children" in the parent project.</p><p class="op-uc-p">Any permission in the child project (for visibility)</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">This action could be triggered from the child (current state) or from the parent or from both.</p><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Create a workspace (e.g project) as a child of another workspace (e.g. portfolio)&nbsp;</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Create Begin of the insertionprojects/programs</p></td><tdEnd of the insertion Begin of the deletion projects/program&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">"Manage children" in the parent project.</p><p class="op-uc-p">Any permission in the child project (for visibility)</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">This is the combination of the permission specifications above. E.g. if a user has both the "Create projects" permission as well as "Manage children" in e.g. a portfolio, a new project can be created with the portfolio as its parent right away.</p><p class="op-uc-p">Create portfolio is not listed as a required global permission as a portfolio cannot be a child.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Copy a workspace (not a template)</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">create Begin of the insertionprojects/portfolios/programs</p></td><tdEnd of the insertion Begin of the deletion projects/portfolio/program&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">"Copy workspace" in the workspace to be copied.</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Workspaces in which the user has "Copy workspace" permission can not be copied. This is for the following reason:&nbsp;<br><br><strong>This is risky as it allows privilege escalation - The user will suddenly e.g. see work packages by copying them to which they potentially didn't have access to in the first place. The alternative would be to still require the project permission of copying the workspace the permission is granted in.</strong></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy a project template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy project template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Projects marked as template are completely copyable. It also does not require the "Copy workspace" permission in the copied Begin of the insertiontemplateEnd of the insertion project.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy a program template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy program template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Programs marked as template are completely copyable. It also does not require the "Copy workspace" permission in the copied Begin of the insertiontemplateEnd of the insertion program.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy a portfolio template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Copy portfolio template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);"><p class="op-uc-p">Portfolios marked as template are completely copyable. It also does not require the "Copy workspace" permission in the copied Begin of the insertiontemplateEnd of the insertion portfolio.</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Turn a workspace into a template</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Manage templates</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Any permission in the project.</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">From #63544 (maybe out of scope) - Projects in which the user has no permission cannot be turned into templates.</p><p class="op-uc-p"><strong>This is risky as it allows privilege escalation. A user might first turn a workspace into a template, then copy it to potentially gain access to information previously not accessible to them.</strong></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Remove a workspace from the set of templates</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Manage templates</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">Any permission in the project.</p></td><td class="op-uc-table--cell" style="border-color:hsl(0, 0%, 60%);padding:9px;"><p class="op-uc-p">From #63544 (maybe out of scope) - Projects in which the user has no permission cannot be removed from the templates.</p></td></tr></tbody></table></figure>

Begin of the deletion Explanation and thoughts about the permissions

End of the deletion * Begin of the insertion\[open\] Should the currently existing &quot;Project&quot; permission group be separated into sections per type:


<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/771225/content">End of the insertion Begin of the deletion Create project/program/portfolio

* This permissions is simply for creating a work space of that type.

* The distinction in permissions is necessary as different users (Project Manager vs Portfolio Manager) will create different types of work spaces


&lt;br&gt;End of the deletion

* Begin of the insertion\[open\] Seeding and migrationsEnd of the insertion Begin of the deletion &lt;br&gt;End of the deletion


**Technical notes**

* <br>


**Permissions and visibility considerations**

* _To whom is this feature visible?_

* _When is it not visible?_


**Translation considerations**

* _Key terms and phrases in the key languages_


**Out of scope**

* <br>


_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._