Roles and permissions

Tollgate governs access at two altitudes. Per-project gates decide who can see and edit a single project’s governance data. A portfolio gate decides who can see the Tollgate Portfolio and use the agent across projects. Separately, Tollgate only requests the platform access its features need — see What Tollgate can access.

Access gates

Per-project

Role	Capability
Jira Project Lead	Edit all governance data by default.
Nominated editors	Jira users the Project Lead adds (stored in per-project app config) who also gain edit rights.
Steering-committee members and named seats	The sponsor (decision authority), project manager, customer and supplier representatives, and every recorded steering-committee member can view the project’s Tollgate surfaces read-only.
Jira project administrators	View (per-project Administer Projects permission), but no edit rights.
Governance-group members	When an app-level governance group is set, its members can also view.

Rules:

• View needs a project role from the table above. A user without one cannot open the project’s Tollgate data.
• Edit stays with the Project Lead and nominated editors. Administer Projects alone confers no edit rights.
• The Project Lead can nominate any Jira user as an editor.
• Without edit rights, the header and registers are read-only.
• Add, Edit, Delete and Link-issue actions are hidden or disabled.
• Row click still opens the read-only detail view, so governance data stays visible.
• The per-project group gate is a no-op until a governance group is set.
• Once a group is set, view and edit also need group membership (or Jira site admin).

Portfolio and agent

• An app-level governance group is configurable from the Tollgate Portfolio settings.
• When set, it gates visibility across the Portfolio and the Rovo agent.
• The portfolio/agent gate defaults to admins-only when no group is configured.
• Once a governance group is set, that group gates everything: per-project surfaces, Portfolio, and agent alike.
• Every Rovo agent action runs behind this gate plus the per-project access gatekeeper (see Rovo agent actions).

Note

The two gates differ when no group is configured. The per-project gate is permissive (a no-op). The portfolio/agent gate is restrictive (admins only). Setting a governance group brings both under the same group.

What Tollgate can access

Tollgate runs entirely on Atlassian’s Forge platform and never sends your data to an external server. It asks for only what its features need:

Access	Why
Your Jira work and users	To read project and issue context, link work packages to issues (writing the work-package reference onto the linked issue via a single app-created custom field), and resolve display names.
Its own private storage	The governance data you enter (work packages, risks, decisions, changes, business cases and status). Stored per project in Tollgate’s own Forge storage, isolated to your site.
Confluence (optional)	Only for the Investment Thesis Supporting documents and Create from template features: to search for and create the linked pages, or attach a file as the evidence of record on a decision. If you don’t use those, Tollgate reads and writes nothing in Confluence.

Note

Tollgate has no ability to send email or notify anyone, and requests no scope that would let it. Every message to a sponsor or approver is one you copy and send yourself. See Submit a business case for approval.

For how Tollgate handles, retains and deletes data, see Security & privacy.