After reading more closely the help, I decided to upload another image, this time showing global project permissions. There is no per-project permissions.

I think your screenshot shows exactly the situation described in the help.. your project is not accessible to the group for all authenticated users (I think it's called "authenticated", if I remember correctly).

Do you mean that the group (the second row on the matrix authorization strategy screenshot) needs to be granted the same permissions as the user who has the most permissions?

No, I mean add a new row for the group called "authenticated" that grants job read permission.

Thank you. It works now.

My only comment is that the documentation could be clearer. It says "...the source project must be accessible to all authenticated users;..." May I suggest instead something like "you must have a group called 'authenticated' and grant the Job Read permission to this group". What confounded me is that I did have the Job Read permission granted for all the users and the group defined in the screenshot, so to me, I was not missing anything. Maybe the error message could say something along these lines as well. Thank you for the help.

Hi I wish to reopen this bug since it is actually a bug for a different reason, namely that the use has access to the selected job if he doesn't use dynamic project name, but hard codes it instead. The fact that one must enable read access for specifying a project via a dynamic variabe vs. specifying it in a hardcoded fashion indicates there is a bug in copy artifacts which should forbid the access unless the authenticated group is added with read permissions for jobs. (This is a very badly documented feature, and has caused me no end of trouble)