症状

Issue Security Scheme has been defined to restrict user from accessing other user's issue, however it does not work as expected.

診断

The Security Level field might be hidden to restrict its visibility to the users. However, this will disregard any default value that has been defined previously.
These are the steps taken to ensure the functionality:

Let's say you have a project named Project A, with 100 existing issues in it:

1. Create a Issue Security Scheme named Issue Security One
2. Add 2 Security Levels, Level 1 and Level 2.
   Level 1 has Admin role assigned to it, Level 2 has Admin and Reporter assigned to it
   Level 2 is set as Default
3. Create a new Field Configuration named Field Configuration One and then set the Security Level field to be hidden
4. Add new Field Configuration Scheme named Field Configuration Scheme Sample, and then associate all issue types to that scheme
5. Assign Field Configuration Scheme Sample to Project A
6. Reindex JIRA
7. Associate Issue Security One to the Project A.
   Choose Level 2 to be associated to the existing 100 issues
8. Login as User A and then create five issues
9. Login as JIRA administrator then change back the Security Level field to be shown
10. Reindex JIRA
11. Login as User B and then create five issues
12. The results show that, though you hide the Security Level field, but when you first associate the Issue Security Scheme, the existing 100 issues will then have a the associated value
    
13. However, the subsequent issues what were created afterwards by User A will not have any Security Level value since the field is hidden
    
14. After showing the field again, now the subsequent issues that were created by User B will have the Security Level default value assigned in it
    
15. As a result, User B can see all his own issues as well as User A's issues
    
    where User A can only see his own issues.
    

ソリューション

This is an expected behavior. If you hide a field through Field Configuration, although it has a default value, the value will not be carried over. If you hide the field in the screen only, and in the Field Configuration it is still shown, then the default value will be carried over.