# Open Point PIR-34 - What permissions do the user performing the request need to have

Project: Project Inititation Requests
Status: decided
URL: https://community.openproject.org/work_packages/PIR-34

## Details

| Attribute | Value |
| --- | --- |
| Involved people |  |
| Assignee |  |
| Decision | We will try 3, but it's okay for 17.0 to require correct config (1) |
| Date |  |
| Module |  |
| Labels |  |

## Related to

_No work packages_

## Description

We want the user to update a work package, and create a file link as a side-effect of the submission of the request.

This could mean:

1.  We simply use the user's own permission set. That would fail if they do not have the above permissions. We can however adapt the global "Role given to authors of new projects" setting to ensure this role has the required permissions set

2.  We use the system user as the author/actor of the update. This would not require any changes, but results in the system user appearing as author and in the comments

3.  We temporarily elevate the permissions of the user when performing the request, so they can do the change. This would be most consistent on the UI, but requires a technically safe way to temporarily augment permissions