**User story**

Begin of the insertion**As an** Portfolio MangerEnd of the insertion Begin of the deletion As an OpenProject AdmininistratorEnd of the deletion

Begin of the insertion**IEnd of the insertion Begin of the deletion IEnd of the deletion want Begin of the insertionto** haveEnd of the insertion Begin of the deletion to set the permissions (read-only, edit, none) of eachEnd of the deletion project Begin of the insertionattributesEnd of the insertion Begin of the deletion attribute in the Administration

SoEnd of the deletion that Begin of the deletion I can ensure the "need-to-know-principle". This means the users can get the information they need - butEnd of the deletion only Begin of the insertionportfolio managers can see or editEnd of the insertion Begin of the deletion the information they need.End of the deletion

Begin of the insertion**SoEnd of the insertion Begin of the deletion <br>

**Permission matrix example**

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p">Attribute A</p></td><td class="op-uc-table--cell"><p class="op-uc-p">Attribute B</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Project Roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Admin</p></td><td class="op-uc-table--cell"><p class="op-uc-p">edit</p></td><td class="op-uc-table--cell"><p class="op-uc-p">edit</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Member</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read-only</p></td><td class="op-uc-table--cell"><p class="op-uc-p">edit</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Reader</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read-only</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">[...]</p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Global roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"><br data-cke-filler="true"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Anonymous</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Non-member</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read-only</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr></tbody></table></figure>

**Complexity Analysis**

* Introduction of mapping of Project attributes <-> role, permissions data structure (5 - 20 PD)

* Admin UI for roles (8 - 12 PD)

* This excludes the "bulk edit" functionality as it becomes too large/impractical very quickly depend on the roles

* Adapt Project dashboard and API for new visibility checks using the new mapping (5 - 25 PD)

* Adapt columns and filters in project lists nowEnd of the deletion that Begin of the insertionI**End of the insertion Begin of the deletion some of the attributes or their values are no longer selectable (10 - 30 PD)

* Open: How to deal with visible attribute in field (Probably remove it) (2  - 4 PD)

* Change validation mechanisms so usersEnd of the deletion can Begin of the insertionmake better decisions for my portfolioEnd of the insertion Begin of the deletion still edit attributesEnd of the deletion without Begin of the insertionhavingEnd of the insertion Begin of the deletion causing validations on e.g., other required custom fields (10 - 30 PD)


**Open**

* Migrations

* HowEnd of the deletion to Begin of the insertionshare all my evaluation with allEnd of the insertion Begin of the deletion handle a very large number of roles and attributes in one table. We might need some filtering later.

* Sections: Will they be hidden or visible when noEnd of the deletion project Begin of the insertionstakeholders.End of the insertion Begin of the deletion attribute is visible?End of the deletion