**As an** Begin of the insertionOpenProject AdmininistratorEnd of the insertion Begin of the deletion openproject instance adminEnd of the deletion

**I want to** set the permissions (read, write, none) of each project attribute Begin of the insertionin the AdministrationEnd of the insertion

**So that I** can ensure the Begin of the insertion"need-to-know-principle". This means the user canEnd of the insertion Begin of the deletion usersEnd of the deletion get the Begin of the deletion relevantEnd of the deletion information Begin of the insertionthey need -End of the insertion but only the information they Begin of the insertionneed.End of the insertion Begin of the deletion need on a global scale.End of the deletion

**Acceptance criteria**

* In Begin of the insertion_Admininistration_End of the insertion Begin of the deletion the project overview details page there is a tab "permission".End of the deletion -> Begin of the insertion_Projects_ -> _Project attributes_ -> <_Attribute A_> there are two sectionsEnd of the insertion Begin of the deletion needs clarification:End of the deletion on the Begin of the insertionright (similar toEnd of the insertion Begin of the deletion project overview or inEnd of the deletion the Begin of the insertionmeetings view).
End of the insertion Begin of the deletion project administration settings? See comment  11/28/2023 1:15 PM by Oliver Günther; we would prefer option 1 (dynamic permissions)
End of the deletion * Begin of the insertion**Write**
Example: Project role A, Project role B
* **Read**
Project role D, Project role C, _Non member_End of the insertion Begin of the deletion In this tab the permissions are defined for all project roles (none, read, write) and for all global roles. -> needs clarification: this tab should also be located in the project administration settingsEnd of the deletion
* In Begin of the insertion_Administration_End of the insertion Begin of the deletion AdministrationEnd of the deletion -> Begin of the insertion_Projects_End of the insertion Begin of the deletion ProjectsEnd of the deletion -> Begin of the insertion_Project attritutes_End of the insertion Begin of the deletion Project attritutesEnd of the deletion there is Begin of the insertionanotherEnd of the insertion Begin of the deletion aEnd of the deletion menu entry Begin of the insertion"_Permissions_"End of the insertion Begin of the deletion "Permissions"End of the deletion showing a two dimensional permission table that gives an overview Begin of the insertionofEnd of the insertion Begin of the deletion acrossEnd of the deletion all project attributes. Begin of the insertion
* The permissions are enforcedEnd of the insertion Begin of the deletion -> needs further specification: see additionEnd of the deletion in Begin of the insertionall relevant views:
* Project overview
* Project list
* APIEnd of the insertion Begin of the deletion permission matrix exampleEnd of the deletion

**Permission matrix example**

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><thead class="op-uc-table--head"><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p"><br data-cke-filler="true"></p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Attribute A</p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Attribute B</p></th></tr></thead><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Project Roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Admin</p></td><td class="op-uc-table--cell"><p class="op-uc-p">write</p></td><td class="op-uc-table--cell"><p class="op-uc-p">write</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Member</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read</p></td><td class="op-uc-table--cell"><p class="op-uc-p">write</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Reader</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">[...]</p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Global roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Anonymous</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Non-member</p></td><td class="op-uc-table--cell"><p class="op-uc-p">read</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr></tbody></table></figure>

**Open**

* Migrations
* How to handle a very large number of roles and attributes in one table. We might need some filtering later. Begin of the deletion
* Introduction of specific project attributes on a project level -&gt; when implemented, a separate permission structure (on project level) has to be specified
* Question: which effects would this have on the project list (and its exports)
* Question: The parallel implementation of attributes for projects and work packages (as suggested by Oliver) raises the follow-up question of filter options. What else would be needed to be able to implement common filters for project attributes and work package attributes?End of the deletion