System roles
Resource Management for Jira uses a role-based access control (RBAC) system. Roles determine what each user can see and do. Two concepts matter: global roles (access to all data of a type) and scoped roles (access only to specific teams or projects).
How roles are assigned
| Role | How it is assigned |
|---|---|
| Admin (Jira app admin) | Instance Admin: Has Jira global permission Administer Jira (Jira site administrator). Resource Management for Jira App Admin (delegated admin): Listed in the app’s delegated-admins list, which is managed by the Instance Admin in the Configuration tab → Users and Roles (Resource Management for Jira App Admins). |
| Team Manager | Assigned as a team lead in the Team Management tab (Organization Structure): the user is set as a team manager at the Organization Structure tab for each team they lead. A user can be team manager for multiple teams. |
| Project Manager | Determined by Jira: any user who is Project Lead for a project, or has Administer Projects permission on that project, is treated as project manager for that project within the app. No assignment is done inside Resource Management for Jira. |
| Viewer | Default for everyone who is not admin, team manager, or project manager. No assignment step. |
A user can have more than one role at once (e.g. Team Manager for some teams and Project Manager for some projects). The app computes separate scopes (managedTeamIds, managedProjectIds) and applies them per feature.
Role purposes (who does what)
-
Delegated admin (Resource Management for Jira App Admin)
Intended for HR or resource managers who need to run the app day to day without being Jira site admins. They typically: maintain the organization structure, assign team members and team leads, and manage calendars. They have full access within Resource Management for Jira but cannot add/remove other Resource Management for Jira App Admins (only Instance Admin can). -
Team Manager
Manages their teams and distributes allocations to projects: they see resource requests assigned to their teams, assign resources from their teams to requests, and move requests through review/reject. They also manage their team members’ rates, calendars, and availability in the Team Management tab. -
Project Manager
Manages their projects: creates and submits resource requests, accepts or rejects assignments proposed by team managers, and closes or cancels requests. They see only requests and data for projects where they have Jira project management rights.
What each role can do (overview)
The following table summarizes capabilities by role. Instance Admin and Resource Management for Jira App Admin both count as admin inside the app; the only difference is that Instance Admin can assign/remove Resource Management for Jira App Admins and has full Jira visibility, while Resource Management for Jira App Admin may see fewer Jira users/projects if Jira permissions are limited.
| Capability | Instance Admin | Resource Management for Jira App Admin (delegated) | Team Manager (scoped) | Project Manager (scoped) | Viewer |
|---|---|---|---|---|---|
| Assign/remove Resource Management for Jira App Admins | ✅ | ❌ | ❌ | ❌ | ❌ |
| Sync users from Jira | ✅ | ✅ | ❌ | ❌ | ❌ |
| Save organization structure (teams, RBS, managers) | ✅ | ✅ | ❌ | ❌ | ❌ |
| Save teams configuration (roles, seniority, priorities) | ✅ | ✅ | ❌ | ❌ | ❌ |
| View/edit teams | All | All | Only managed teams | Read-only (all) | ❌ |
| View/edit resources (team members) | All | All | Only managed teams’ resources | ❌ | ❌ |
| Save resource (rates, calendar, availability) | Any | Any | Only resources in managed teams | ❌ | ❌ |
| Create/edit/archive calendars | ✅ | ✅ | ❌ | ❌ | ❌ |
| Read calendars | ✅ | ✅ | ✅ | ✅ | ✅ |
| View resource requests | All | All | Only requests for managed teams | Only requests for managed projects | ❌ |
| Create resource request | Any project | Any project | For managed teams only | For managed projects only | ❌ |
| Submit / accept / close / cancel request (PM actions) | ✅ | ✅ | ❌* | For managed projects | ❌ |
| Assign resource / send to review / reject (TM actions) | ✅ | ✅ | For managed teams | ❌* | ❌ |
| Timesheets | All (Team + Project views) | All (may be limited by Jira) | Team view (managed resources) | Project view (managed projects) | Own timesheets only |
| Configuration tab | ✅ | ✅ | ❌ | ❌ | ❌ |
| Team Management tab | ✅ | ✅ | ✅ (filtered) | ❌ | ❌ |
* A user who is both TM and PM can perform TM actions on requests for their teams and PM actions on requests for their projects; they cannot perform TM actions on a project they only manage as PM.
Tab access by role
| Tab | Instance Admin | Resource Management for Jira App Admin | Team Manager | Project Manager | Viewer |
|---|---|---|---|---|---|
| Requests | ✅ All | ✅ All | ✅ Filtered (managed teams) | ✅ Filtered (managed projects) | ❌ |
| Team Management | ✅ | ✅ | ✅ Filtered (managed teams only) | ❌ | ❌ |
| Organization Structure | ✅ | ✅ | ✅ Filtered (managed teams) | Read-only | ❌ |
| Calendars | Read/write | Read/write | Read-only | Read-only | Read-only |
| Timesheets | ✅ All | ✅ All | ✅ Team view | ✅ Project view | ✅ Own only |
| Configuration | ✅ | ✅ | ❌ | ❌ | ❌ |
Scoped vs global roles
-
Global (admin)
Instance Admin and Resource Management for Jira App Admin see all teams, resources, and resource requests in the app (subject to Jira visibility for Resource Management for Jira App Admin). No team or project filter is applied. -
Scoped (Team Manager, Project Manager)
- Team Manager: Access is limited to teams where the user is set as a Team manager at the Organization structure tab. They see and act only on those teams, their members, and requests assigned to those teams.
- Project Manager: Access is limited to Jira projects where the user is Project Lead or has Administer Projects permission. They see and act only on requests and timesheets for those projects.
The system enforces these scopes on every relevant API call; the UI only shows data the user is allowed to see.
Jira permissions that affect roles
-
Instance Admin
Requires Jira global permission Administer Jira. -
Resource Management for Jira App Admin
No extra Jira permission is required to be assigned (Instance Admin does that in Configuration). For full functionality (e.g. seeing all users and projects in the app), they should have:- Browse Users and Groups (global), and
- Browse Projects (project or global),
as described in the warning shown in the Configuration tab when managing Resource Management for Jira App Admins.
-
Project Manager
For each project, the user must be Project Lead for that project or have Administer Projects permission on it (from Jira project permissions). The app does not store this; it is derived from Jira on each request.
Summary
| Role | Type | Assigned via | Typical use |
|---|---|---|---|
| Instance Admin | Global | Jira (Administer Jira) | Full Jira + full app control; can assign Resource Management for Jira App Admins. |
| Resource Management for Jira App Admin (delegated admin) | Global (within app) | Configuration → Users and Roles (Instance Admin only) | HR/resource managers: org structure, team leads/members, calendars. |
| Team Manager | Scoped (teams) | Team Management tab → team lead on each team | Manage their teams and distribute allocations to projects. |
| Project Manager | Scoped (projects) | Jira (Project Lead or Administer Projects) | Manage their projects and resource requests. |
| Viewer | Default | (none) | View own timesheets and read calendars only. |