FieldLock for Jira › Guides
"Field-level security" is one search phrase for two different problems. Before you pick a tool, decide which of them you actually have.
Jira's permission model is built on projects and issues. If you can edit an issue, you can edit every field on it that appears on the screen. Requests to change that are among the oldest: JRASERVER-1330 was filed in 2003 and closed as Won't Fix in 2007, and JRACLOUD-69298 — "allow fields to be hidden/edited" by specific users — has hundreds of votes and no delivery date.
Note the wording: hidden or edited. Those are two separate needs.
Typical fields: salaries, personal data, legal notes, anything confidential. The goal is that unauthorised users cannot read the value at all.
Typical fields: contract value, budget, an agreed estimate. Everyone may see the number — that is the point — but nobody should be able to quietly overwrite it.
| If your sentence sounds like… | You need |
|---|---|
| "Not everyone should see the salary field" | hiding (view restriction) |
| "Only managers should change this value" | edit restriction |
| "Changes need an approver and a reason" | edit restriction + approval |
| "We need to prove who agreed to this number" | edit restriction + audit trail |
FieldLock for Jira solves problem 2 only. A protected field cannot be changed directly — not in the issue view, not through the REST API, not by bulk edit, not by automation. Changes go through the FieldLock panel: a request with a reason, approved by project admins or a project role you choose (an optional rule blocks self-approval), or a direct change by an approver — both logged. Every event goes into an append-only audit trail that exports as a readable document and JSON.
FieldLock does not hide values. If your need is problem 1, FieldLock is the wrong app — and we would rather you know that before installing.
Which field, and how hard the block is, depends on the mode. The refusal described above is Locked mode, and Locked always uses the app's own numeric field. Guarded mode protects a custom field you already have — a number or a single-line text field, such as a contract number — but there the outside change goes through and FieldLock restores the approved value shortly after, usually within a minute or two. Dates, multi-line text and built-in Jira fields such as Due date are not supported in either mode. Compare the two modes.
Free trial through the Atlassian Marketplace. Paid plans start at $10/month for up to 10 users.