Restrict access with governance groups

Mode: how-to. Restrict who can see Tollgate governance data to a named Jira group.

By default the Portfolio is visible to Jira admins only, and each project’s Tollgate tab falls back to that project’s own members. Setting a governance group changes that. The group gates the Portfolio view, every project’s governance tabs, and the Tollgate AI agent. Only its members and Jira admins keep access.

Set an access group

1. Open Apps → Tollgate Portfolio.
2. In the page header, open the Settings menu and choose Who can see this portfolio.
3. Enter the name of an existing Jira group — for example sapper-pmo-governance.
4. Select Save group. Access now narrows to that group’s members and Jira admins.

Who can do what once a group is set

The group gates everything. Project membership alone is no longer enough. A project lead outside the group cannot open Tollgate on their own project.

	Can open Tollgate	Can edit
In the governance group, and the project’s lead or a nominated editor	Yes	Yes
In the governance group, no role on the project	Yes	No
Jira site admin, outside the group	Yes	Only if they are the project’s lead or a nominated editor
The project’s lead, outside the group	No	No
Everyone else	No	No

Two rules sit behind that table:

• Opening Tollgate needs group membership (or Jira site admin).

• Editing needs, on top of that, the project’s lead or a nominated editor.

  Administering Jira does not confer it. The people accountable for the investment edit the governance data.

Caution

Creating a Jira project does not grant Tollgate access. The creator becomes that project’s lead, but if they are outside the governance group they will see “Access restricted” on the Tollgate tab. This is deliberate: the group decides who reaches the governance layer.

That leaves a new project nobody can edit: only the project lead can nominate editors, and the lead is locked out. To resolve it, a Jira admin does one of:

1. Add the lead to the governance group — they get their own project back.
2. Reassign the Jira project lead to somebody in the group, in Project settings → Details.
3. Remove the access group, if gating the site was not the intent.

Note

A Tollgate tab with no buttons means you can view but not edit. You are in the group, but you are not the project’s lead or a nominated editor. Ask the lead to nominate you.

Remove the restriction

1. Reopen Settings → Who can see this portfolio.
2. Select Remove access group, then confirm.
3. The Portfolio reverts to Jira admins only, and each project’s tabs fall back to that project’s own members.

Caution

If the configured group is later deleted or renamed in Jira, access silently reverts to admins only. Tollgate shows a warning banner — “Access group no longer exists” — so set a valid group again to restore access.

Note

The group must already exist in Jira. Tollgate verifies it on save. This gate lets delivery teams work in Jira while steering members read the governance layer in Tollgate.