**As an** OpenProject Admininistrator

**I want to** set the permissions Begin of the insertion(read-only, edit,End of the insertion Begin of the deletion (read, write,End of the deletion none) of each project attribute in the Administration

**So that I** can ensure the "need-to-know-principle". This means the Begin of the insertionusersEnd of the insertion Begin of the deletion userEnd of the deletion can get the information they need - but only the information they need.

**Acceptance criteria**

* In _Admininistration_ -> _Projects_ -> _Project attributes_ -> <_Attribute A_> there Begin of the insertionis a section "Permissions"End of the insertion Begin of the deletion are two sections on the rightEnd of the deletion (similar to the Begin of the insertion"Participants" section in theEnd of the insertion meetings view).
* Begin of the deletion **Write**
End of the deletion Example: Begin of the insertion
* End of the insertion Project role Begin of the insertionA (read-only)
End of the insertion Begin of the deletion A, Project role B
End of the deletion * Begin of the deletion **Read**
End of the deletion Project role Begin of the insertionD (edit)End of the insertion Begin of the deletion D, Project role C, _Non member_End of the deletion
* In _Administration_ -> Begin of the insertion_Users and permissions_End of the insertion Begin of the deletion _Projects_ -> _Project attritutes_End of the deletion there is another menu entry Begin of the insertion"_Permissions project attributes_"End of the insertion Begin of the deletion "_Permissions_"End of the deletion showing a two dimensional Begin of the insertionpermissionsEnd of the insertion Begin of the deletion permissionEnd of the deletion table that gives an overview of all project attributes.
* The permissions are enforced in all relevant views:
* Project overview
* Project list
* API

**Permission matrix example**

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><thead class="op-uc-table--head"><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p"><br data-cke-filler="true"></p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Attribute A</p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Attribute B</p></th></tr></thead><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Project Roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Admin</p></td><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">edit</p></td><tdEnd of the insertion Begin of the deletion class="op-uc-p">write</p></td><tdEnd of the deletion class="op-uc-table--cell"><p class="op-uc-p">write</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Member</p></td><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">read-only</p></td><tdEnd of the insertion Begin of the deletion class="op-uc-p">read</p></td><tdEnd of the deletion class="op-uc-table--cell"><p class="op-uc-p">write</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Project Reader</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">read-only</p></td></tr><trEnd of the insertion Begin of the deletion class="op-uc-p">read</p></td></tr><trEnd of the deletion class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">[...]</p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>Global roles</strong></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td><td class="op-uc-table--cell"><p class="op-uc-p"></p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Anonymous</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td><td class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p">Non-member</p></td><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">read-only</p></td><tdEnd of the insertion Begin of the deletion class="op-uc-p">read</p></td><tdEnd of the deletion class="op-uc-table--cell"><p class="op-uc-p">none</p></td></tr></tbody></table></figure>

**Open**

* Migrations
* How to handle a very large number of roles and attributes in one table. We might need some filtering later.