ACP-120 access, permissions, security: what the exam tests

The exam guide names three admin types for Jira Cloud: org admin, Jira admin and project admin. Even a Jira admin's Administer Jira permission cannot manage users, import data or edit system email settings.

01 What does ACP-120 test about access, permissions and security?

A mock exam question asks why a user can see a work item but not edit it, and several answers look possible. This domain is about how product access, global permissions, project permissions, workflow conditions and issue-level security depend on each other.

What the exam asks about in this domain

1. 01Admin typesOrg admin, Jira admin and project admin
2. 02Team-managed accessAccess levels and roles, versus permission schemes
3. 03Permissions in combinationWhat each permission does and which ones work together
4. 04Roles and groupsWhen to use project roles and when to use groups

Expect questions on how the layers of access depend on each other.

02 What can each admin type do?

Org and site admins must add themselves to the jira-administrators group to get Administer Jira. Jira admins inherit the Administer spaces permission automatically.

A space admin without Administer Jira can edit the space name, lead and role membership, and define components and versions. They can view the space's schemes but cannot select or edit them.

Without Administer Jira, a space admin can view schemes but not change them.

03 How do permissions combine?

Almost all work item permissions also need Browse spaces. Moving work items needs Move work items plus Create work items in the destination, and linking across spaces needs Link work items in both.

Someone with Assign work items but not Edit work items can change only the Assignee field.

When two permissions overlap, the most specific one decides.

04 How does access work in team-managed spaces?

In a team-managed space, the Access page controls every permission, and you give people a role there.

Team-managed access levels

Open

• Everyone gets the Member role
• View, create and edit

Limited

• Everyone gets the Viewer role
• View and comment only

Private

• Jira admins and added people
• Hidden from everyone else

Roles you assign add to the access level's role rather than override it. On the Free plan you cannot edit space permissions or roles.

Team-managed roles add to the access level; they do not override it.

Summary

1. Administer Jira cannot manage users or import data.
2. Almost every work item permission also needs Browse spaces.
3. A Private team-managed space is visible only to Jira admins and added people.

Sources

1. ACP-120 Exam Topics V2 Version Date: April 2025 1 Access, Permissions, Security (28% of the exam)
2. What are global permissions, and what do they control? | Atlassian Support
3. Manage how people and agents access your team-managed space | Jira Cloud | Atlassian Support
4. Space access and configuration permissions | Atlassian Support
5. Configure spaces | Atlassian Support
6. How permissions interact with each other | Atlassian Support
7. Add people to team-managed spaces | Jira Cloud | Atlassian Support