Ugh, wtf? I was hoping for *more* of these types of settings, not less.

We should be more concerned about how it affects our non-Spaces workflow.

Upstream has created a new system for custom forms which allow us to create multiple versions of the task creation form. Some versions of the form can have policies restricted and we can create policies that control who can use each version of the form.

It's a bit more complicated to set up but the end result is a more user friendly task editing UI where people who shouldn't see policy controls won't even see them.

So we can actually prevent people who shouldn't be editing visibility policies (both task and project, and others...) from doing so, using the new system?

We can. But the problem is, if we want that people can change the policy (indirectly), if they report a security issue. The security extension is the problem. An altnernative solution could be this task: https://secure.phabricator.com/T10061

@Aklapper: To elaborate on what I said above, after playing with the new forms on phab-01, it looks like we shouldn't need to change much in the workflow.

So instead of

add "Allow members of acl*groupname_policy_admins" to Phabricator's global custom "Can Edit Task Policies" setting.

We set up two separate task forms, one with policy controls like this:

• https://phab-01.wmflabs.org/transactions/editengine/maniphest.task/view/8/

And one without, like this:

• https://phab-01.wmflabs.org/transactions/editengine/maniphest.task/view/3/

Then we set who can use the edit task policies form, like this:

• https://phab-01.wmflabs.org/transactions/editengine/maniphest.task/edit/8/

And simply limit the more powerful form to members of the appropriate acl*groupname_policy_admins projects.

Thanks, as far as I understand it this all makes sense.

Visually I love what I've seen so far on phab-01. Adding screenshots from phab-01:

• "Create item" dropdown menu:

• Create Security task form:

So I guess we can close this now. Let users adjust spaces is possible via a third form, so this is not a problem (Custom policy for this form, so that not all users can use this (create and edit form)).

I think the main problem is solved by D113, so we can close this, if D113 is ready?