[rt-users] Reasons for ModifyTicket granting CommentOnTicket?

[Chris Dunning]

The first line support techs on my helpdesk have no need to comment on a
ticket.  In all cases they should be replying to the requestor.  Rather
than try to educate them about the difference and monitor to make sure
they're doing it, I would like to remove their commenting rights
completely.  I have removed their rights to 'CommentOnTicket', but they
must have 'ModifyTicket' so that they can move the ticket to a different
queue, assign it to a higher level tech or resolve it.  Apparently
'ModifyTicket' implicitly gives the right to 'CommentOnTicket.'

I see in the mailing list archives that this issue has been discussed
before:
http://www.gossamer-threads.com/lists/rt/users/62608?search_string=modifyticket%20commentonticket;#62608

That message is specifically about 3.6.1.  I just upgraded to 3.6.3 and
have the same issue.  Following Olaf's lead I modified four files:
- html/Ticket/Update.html
- html/Ticket/ModifyAll.html
- html/Ticket/Elements/Tabs
- html/Ticket/Elements/ShowTransaction

Olaf changed the "or" to "and," I simply removed the references to
ModifyTicket.  I suppose at some point I might have users who can reply
and/or comment on a ticket but are not allowed to move or resolve the
ticket.

The questions I want to ask:
-Is it necessary for ModifyTicket to implicitly grant reply/comment
rights, if there are separate rights for ReplyToTicket and
CommentOnTicket?  Logically it does make sense that someone with the
authority to modify a ticket has, in most cases, the authority to reply
to a ticket.  Maybe Olaf and I are the only users who don't follow the
norm on this.

-Are there any other places I need to change?

-Does anyone foresee any problems with this setup?  I've made a few
quick tries to circumvent the permissions by changing the URL parameters
but it still defaults to reply.  I'm not particularly worried about my
users attempting to comment on the ticket for some malicious purpose,
I'm only worried that they will use the "comment" feature
absent-mindedly without realizing that the customer will never receive
the message.  That said, maybe I should just remove the buttons for
commenting - if they need to comment, they can click "reply" then change
the dropdown...I may do that.

Anyway, thanks for reading - and thanks to BP for putting out such a
great program.  It beats out everything else I've tried.