How To: Set the right permissions for endusers

If you want that endusers just have access to their tickets and activities it's just necessary that you create an enduser role with access to all workitems.

The underlying enduser profile won't give access to all workitems at all but the enduser will have implied permissions to related items. With that setting endusers can see the work items they openend and approve and complete RAs and MAs as well.