Please let me know if you agree with this capability matrix of the role "COMMUNITY_USER" (the role you describe above):

Community user can:

• view issues
• create issues
• comment on issues
• update their own issue description/title
• change priority

Community user cannot:

• change severity
• change workflow state (unless you explicitly allow “close own issue” later)
• touch projects, branches, PRs
• access premium features

Internal users can:

• everything appropriate to their role

Also note that this is different from OBSERVER role which by contract has read only access to all elements but no write access.

Release 1.8 – Community User Support (Deliberate Capability Boundaries)

This section describes explicitly and intentionally what support for community users includes in release 1.8, and what it does not include.

The goal is to make the capability boundaries clear, deliberate, and predictable, so that missing functionality is not misinterpreted as a defect.

A product is buggy when it exhibits unintended behavior.
A product with declared limitations is exercising design control.

What COMMUNITY_USER WILL DO in 1.8

A user with the predefined role COMMUNITY_USER can:

• View issues
• Create new issues
• Comment on existing issues
• Change issue priority

These capabilities are intended to support external contributors and community members who do not work on the codebase but can meaningfully participate by reporting problems and providing feedback.

What COMMUNITY_USER WILL NOT DO in 1.8

(Intentionally not supported, even where future versions may extend this)

A user with the role COMMUNITY_USER cannot:

• Change issue severity
  (Severity is a maintainer/engineering assessment.)

• Change issue workflow state
  (e.g., open, in progress, closed.)

• Edit issue title or description after creation

• Create, modify, or manage projects

• Create, modify, or manage branches

• Create, modify, or manage pull requests

• Access premium or licensed features

These exclusions are intentional design choices for release 1.8 and should not be treated as defects.

Notes on intent

• The COMMUNITY_USER role is predefined and non-configurable.
• Community users are non-billable and excluded from license counts.
• Internal team members retain full capabilities according to their assigned roles.
• Additional capabilities may be introduced incrementally based on real-world usage and feedback.

This explicit scope is meant to ensure clarity, prevent accidental privilege expansion, and reduce unnecessary defect reports caused by misaligned expectations.