Permissions
What the app asks Jira for
| Scope | Why |
|---|---|
| read:jira-work | Read issues and worklogs, run searches for your week and for reports, and receive worklog events. |
| write:jira-work | Create, edit and delete your worklogs when you use the grid or the panel. |
| read:jira-user | Look up your account and time zone, and search for users when an admin builds a team. |
| storage:app | Store billable flags, attributes, settings, teams, timesheet records and saved reports in Atlassian's Forge storage. |
| report:personal-data | Report the account IDs the app stores to Atlassian once a week, as Atlassian requires, so the app can erase people whose accounts were closed and update changed names. |
Worklog calls from the grid and panel run as the signed-in user, so Jira's own permissions apply.
Who can do what
| Action | Who |
|---|---|
| Log time, submit own timesheet, run and save reports | Any user |
| Set billable and attributes on a worklog | The worklog's author |
| Review a team's timesheets, approve, reject | The team's lead, or a Jira administrator for any team |
| See the dashboard gadget for a team | Team members, the lead, and Jira administrators |
| Admin page: settings, attributes, teams, Tempo import, data export | Jira administrators only (checked with Jira's Administer Jira permission on each call) |
There are no separate app roles. The roles are Jira administrator, team lead and everyone else.
A team lead sees only the teams they lead in Approvals. A lead cannot review a team they do not lead, or a person outside their team.
What a user can see
Reports and the grid use native Jira reads as the viewer. A user sees worklogs on issues they can browse. The billable flag and attributes of a worklog are shown only to people Jira lets see that worklog. Imported Tempo author data is never shown on these screens.
When the subscription is not active
The timesheet page, the panel, the gadget and the admin page show a message instead of data. Jira administrators can still download all app data from the admin page. The app keeps its stored data in step with worklog changes made in Jira, so the data is correct if the subscription returns.
Network
The app makes no calls to servers outside Atlassian. Files you import are read in your browser, and exports are built in your browser.