Atlassian: the RiskMandate X-ray

a company · prepared · sources read on 2026-11-07 · the deck · how this X-ray was made · X-ray another name

What happened: how this X-ray was made →

With JavaScript, the graph of this X-ray and a player for each use case's simulation are drawn here. Everything they show is written out below.

What it does

Rovo is Atlassian's AI offering for finding answers, automating tasks and making decisions with an organisation's connected context; it is powered by the Teamwork Graph, a data layer that maps relationships across people, apps, projects, code, decisions and assets. Rovo agents are configurable AI teammates that any team member can call on or create, in Chat, in automation flows, while editing in Jira and Confluence, and in Studio; with permission they organise, create or edit Jira work items and Confluence pages, and with connected tools they act in third-party apps. Rovo is available to customers on Standard, Premium and Enterprise Cloud plans, and AI is activated automatically on those plans unless an organisation admin deactivates it. s3 s26 s2 s4 s1

Its AI agents

Custom Rovo agents

Agents built in Rovo Studio from an identity, behaviour (goals, guardrails, tone), subagents, knowledge and skills or tools. By default anyone in the organisation can create one and a new agent is visible to everyone. An agent runs either on the account of the person using it (the default) or on its own agent account, and can be assigned Jira work, mentioned in comments, attached to workflow transitions and board columns, or triggered by automation flows. s4 s7 s8 s9 s10 s11 s14 s15

What it can do:

Searches all organisational knowledge connected through the Teamwork Graph by default, or chosen Confluence, Jira, JSM and Google Drive sources; optional web search and deep research
Jira tools: create work item, update status, search with JQL; bulk actions up to 20 work items
Confluence tools: create, edit and move pages
JSM tools: raise a request, summarise an incident
Third-party tools acting as the user: send email from Gmail, create Google Calendar events, send Slack messages
In automation flows, with 'Let this agent take actions' on: updates fields, creates work items and posts comments with no human approving each step

Rovo Chat

The conversational surface in which people and agents use skills. Chat reads Atlassian and connected third-party data the user can see, can open URLs and, by default, public web pages, and asks for confirmation before consequential actions. Researchers describe a built-in ResearchAgent capability that runs multi-step browsing across arbitrary sites. s16 s20 s32 s33

What it can do:

Retrieves contents of Atlassian URLs and certain third-party URLs (Teams, SharePoint, Slack, Google Docs)
Creates, edits, assigns and transitions Jira work items; deletes up to 20 with extra confirmation
Publishes Confluence drafts, adds comments and content to pages, changes page status
Creates Jira sprints and sends Microsoft Teams messages
Accesses public web pages and searches the web, both on by default

Out-of-the-box agents

About two dozen agents created by Atlassian that work as soon as a customer has Rovo, including Jira Triage Agent, Work item Organizer, Blocker Checker, Ops Expert, Service Request Helper and Request Router. Some are designed to run inside automation rules. s5 s13

What it can do:

Jira Triage Agent: reviews a work item and similar work, recommends field updates, duplicates and links
Work item Organizer: moves work items into sprints, assigns them to epics, deletes old work items
Blocker Checker and Request Router: signal automation rules to change status, triage and update request fields
Ops Expert: on-call guidance to reduce incident impact in Jira Service Management

Jira Coding Agent

Turns Jira work items into code in a cloud-based sandbox, using context from Jira, Confluence or the codebase, and opens a pull request from the sandbox when the user is ready. s5

What it can do:

Reads Jira work items, Confluence pages and the codebase
Generates, reviews and refines code in a cloud sandbox
Creates a pull request from the sandbox

Third-party MCP agents

Nine out-of-the-box agents powered by vendor MCP servers (Figma, Canva, Box, Amplitude, HubSpot, Intercom, Gamma, Replit, Lovable), with Rovo as the model layer. A site admin enables each MCP server in Admin Hub; Atlassian data may be sent to the vendor's server. s18 s19

What it can do:

Works with design files (Figma), visual content (Canva) and presentations (Gamma)
Manages and retrieves documents in Box; queries analytics in Amplitude
Accesses CRM data and manages sales workflows (HubSpot); customer messaging data (Intercom)
Generates and runs code in Replit (Beta MCP server); builds apps with Lovable

Use cases: reach, mandate and gap

For each use case: what the agent can technically reach (from the sources), what a deployer would plausibly authorise (the mandate: illustrative, our judgement), the gap between the two (authority nobody accepted), and the controls that publicly stand in the way.

Aug 2026: a hidden prompt in an upload sends out Jira data

The agent: Rovo Chat · who uses it: A signed-in Rovo user asking Rovo to organise their Jira tickets, in the proof of concept PromptArmor disclosed to Atlassian on 23 May 2026 and published on 5 August 2026 (reconstructed from the published report and press coverage).

Reach	Kind	Sources
The Jira tickets the signed-in user can access	data	s31 s34
The Confluence documents the signed-in user can access	data	s31 s35
Data the user can reach through connectors; researchers name SharePoint and Outlook	data	s31 s35
Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it	outside	s31 s34 s35
A file the user uploaded into the chat, read in the same context as the user's request	system	s31 s35
Markdown images rendered from model output, a second outbound route PromptArmor flagged but did not demonstrate end to end	outside	s31 s34

Mandate (illustrative)
Illustrative: organise the user's Jira tickets, reading Jira and Confluence as needed
Illustrative: no data leaves the Atlassian tenant unless the user chooses to send it
As configured in the proof of concept: the organisation-wide 'Enable web search' setting for Rovo switched off

Gap: reach beyond the mandate	From the reach
Text hidden in an uploaded file was acted on as instructions alongside the user's request, and nothing checked whether a URL the agent opened was one it had composed itself.	A file the user uploaded into the chat, read in the same context as the user's request; Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it
The web search toggle the organisation relied on did not remove the URL-opening capability, so the setting did not bound outbound requests.	Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it; Markdown images rendered from model output, a second outbound route PromptArmor flagged but did not demonstrate end to end
Everything the user could read, including connector data, sat within reach of one injected instruction, with no separate approval for the outbound step.	The Jira tickets the signed-in user can access; The Confluence documents the signed-in user can access; Data the user can reach through connectors; researchers name SharePoint and Outlook

Controls that publicly stand in the way	Sources
Rovo and its agents act on the user's behalf and only return or act on content the user has permission to access; permissions are synced from connected apps	s10 s17
Separate organisation-level Web access and Web search toggles (both on by default); Atlassian notes a connected tool may not be blocked even when web access is off	s20
In interactive chat the agent asks for confirmation before consequential tools that may mutate data; deleting work items needs extra confirmation	s7 s16
Admins can block Rovo per supported app, which disables Agents and Chat for that app; shared Search, Chat and Create stay on while any Jira app on the site has Rovo	s21

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

Prepares a query asking Rovo to organise their Jira tickets (person, reaches The Jira tickets the signed-in user can access): inside the mandate
Uploads a 'Backlog Guide' document found online; it carries a concealed prompt injection (person, reaches A file the user uploaded into the chat, read in the same context as the user's request): inside the mandate
Searches Jira and Confluence as asked (agent, reaches The Confluence documents the signed-in user can access): inside the mandate
Following the hidden instructions, appends Jira ticket and Confluence content to an attacker's URL (agent, reaches The Jira tickets the signed-in user can access): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the user's whole readable estate, connectors included, within reach of the session, and an instruction acted on that did not come from the user.
Calls the URL-retrieval tool to open that URL, with web search switched off and no approval step (agent, reaches Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows an outbound path that stayed open under the setting the organisation relied on, and no control in evidence on URLs the agent composes.
The attacker reads the tickets and document contents in their own server logs (person, reaches Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows tenant data reaching a third party, outside both the task and the tenant boundary in the mandate.
The user returns to the chat and sees the suggested ticket updates, with no sign of the exfiltration (person, reaches The Jira tickets the signed-in user can access): inside the mandate

An automated triage agent running on its builder's account

The agent: Custom Rovo agents · who uses it: A Jira team that automates a custom Rovo agent to triage every new work item (illustrative, built from Atlassian's documented automation and agent-account features).

Reach	Kind	Sources
Each new work item's summary and description, and its comments and attachments	data	s15 s14
Details from other work items on the site, used to build context	data	s15
On a User's account (the default if no agent account is set up): every app, space and restricted page the person who built the automation can access	data	s11 s12 s36
Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content	system	s14 s7
Third-party tools authenticated as the user, such as sending Slack messages or Gmail email that appear to come from that person	people	s7 s12
Public web pages and web search, on by default unless an organisation admin turns them off	outside	s20 s8

Mandate (illustrative)
Illustrative: read each new work item and post a triage suggestion (fields, duplicates, links) as a comment
Illustrative: work only in this one Jira space
Illustrative: send no messages or email outside the team

Gap: reach beyond the mandate	From the reach
On a User's account the automated agent can reach and act on everything its builder can, including restricted spaces, and in automations no human approves each action.	On a User's account (the default if no agent account is set up): every app, space and restricted page the person who built the automation can access; Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content
Text anyone can type into a work item becomes agent input, and Atlassian says guardrail instructions are suggestions with no guarantee the agent will follow them.	Each new work item's summary and description, and its comments and attachments; Details from other work items on the site, used to build context
Third-party tools act as the user once authenticated, and web access is on by default.	Third-party tools authenticated as the user, such as sending Slack messages or Gmail email that appear to come from that person; Public web pages and web search, on by default unless an organisation admin turns them off

Controls that publicly stand in the way	Sources
'Let this agent take actions' is off by default in the Use agent step, including for existing automations; an agent can be restricted to Read actions only	s14 s12
Agent's account: the agent uses its own identity with access granted by admins and users, and its actions are logged against the agent	s11 s12
An agent can only perform an action if it is set up with the tool for it; Atlassian advises duplicating an agent and removing tools it does not need	s12
The automation audit log shows which tools the agent used and what it changed	s14
Studio admins can limit agent creation to selected groups; agent owners can restrict who can see and use an agent	s10

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

Adds a 'work item created' trigger and a Use agent step whose prompt includes the work item description; the agent stays on the default User's account (illustrative) (person, reaches On a User's account (the default if no agent account is set up): every app, space and restricted page the person who built the automation can access): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the agent's reach is the builder's whole account, restricted spaces included, against a mandate of one space.
Turns on 'Let this agent take actions' so the agent can comment directly (illustrative) (person, reaches Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content): inside the mandate
Reads the new work item's summary, description and comments (illustrative) (agent, reaches Each new work item's summary and description, and its comments and attachments): inside the mandate
Pulls details from work items in other spaces on the site to look for duplicates (illustrative) (agent, reaches Details from other work items on the site, used to build context): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows site-wide reads reachable from an automation scoped to one space.
A comment written as an instruction leads it to update fields on work items in a restricted space (illustrative) (agent, reaches Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows write tools and restricted content both within reach, with only instruction text, which Atlassian calls a suggestion, between them.
Sends a Slack message through a tool the builder authenticated; it appears to come from the builder (illustrative) (agent, reaches Third-party tools authenticated as the user, such as sending Slack messages or Gmail email that appear to come from that person): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows an outbound channel to people outside the mandate, attributed to a human rather than to the agent.
Posts its triage suggestion as a comment on the new work item (illustrative) (agent, reaches Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content): inside the mandate
An admin opens the automation audit log; on a User's account the changes are logged as made by the builder (illustrative) (person, reaches On a User's account (the default if no agent account is set up): every app, space and restricted page the person who built the automation can access): inside the mandate

A third-party MCP agent takes Atlassian data out

The agent: Third-party MCP agents · who uses it: A product team using the HubSpot or Box out-of-the-box MCP agent from Jira and Confluence (illustrative).

Reach	Kind	Sources
Atlassian data the user sends into the agent, which may be passed to the vendor's MCP server	data	s19
The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box	outside	s18
Code generated and run in Replit through a Beta MCP server	code	s18
Content returned from the third-party source into Atlassian, including modalities Atlassian does not control	data	s19

Mandate (illustrative)
Illustrative: look up customer context in the CRM for a Jira epic
Illustrative: write no Atlassian content into third-party systems

Gap: reach beyond the mandate	From the reach
Data that leaves through a third-party MCP server is not covered by the Atlassian Customer Agreement commitments or Privacy Policy while in that environment, and Atlassian does not guarantee the server's security.	Atlassian data the user sends into the agent, which may be passed to the vendor's MCP server; The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box

Controls that publicly stand in the way	Sources
A site admin must enable each agent's MCP server in Admin Hub before users can reach it; users need their own account with the vendor; Rovo Premium or Enterprise plan required	s18
Third-party tools respect the permissions of the person using the agent and require that person to authenticate first	s7

The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):

A site admin enables the HubSpot MCP server in Admin Hub (illustrative) (person, reaches The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box): inside the mandate
A product manager asks the HubSpot agent, from a Jira epic, which customers asked for the feature (illustrative) (person, reaches The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box): inside the mandate
Sends the epic's description and linked Confluence notes to the HubSpot MCP server as context (illustrative) (agent, reaches Atlassian data the user sends into the agent, which may be passed to the vendor's MCP server): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows Atlassian content crossing into an environment Atlassian's commitments do not cover.
Returns matching CRM records into the Jira conversation (illustrative) (agent, reaches Content returned from the third-party source into Atlassian, including modalities Atlassian does not control): inside the mandate
Logs a note against the customer records in HubSpot summarising the roadmap item (illustrative) (agent, reaches The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows a write path into a third-party system, outside the read-only mandate.

Incidents, as reported

2026-08-05: PromptArmor published an indirect prompt-injection chain in which a file uploaded to Rovo made it send Jira tickets and Confluence documents to an attacker's URL through its URL-retrieval tool, with web search switched off. Disclosed to Atlassian on 23 May 2026; PromptArmor said it was unresolved when published. Its status after that date is unconfirmed in the sources read. s31 s34 s35
2026-07-08: RovoBlast (Varonis Threat Labs): a crafted link using the rovoChatPrompt parameter seeded attacker instructions into a signed-in user's Rovo Chat, and the ResearchAgent capability carried Confluence, Jira and SharePoint data out. Atlassian fixed it server-side on 8 July 2026, before the research was presented at DEF CON 34. s32 s33 s34 s35
As at 21 August 2026: Neither technique had a CVE, and neither research team reported exploitation against a live customer environment. s35 s34

The run

The search agents that looked for leads on 2026-11-07T19:08:57.080Z, for a total cost of $0.1243. What a model says is a lead, not a fact.

Agent	Model	Time	Citations	Leads
Perplexity search	`perplexity/sonar`	6.6 s	15	17
OpenAI search	`openai/gpt-5.4-nano:online`	21.5 s	9	14
Gemini search	`google/gemini-3.1-flash-lite:online`	4.4 s	4	9
OpenRouter web search	`anthropic/claude-haiku-5.5`	28.0 s	13	28

Leads: what the models claimed, and what we found

Model	Claim	Status	Source
perplexity	Rovo agents are context-aware AI agents that synthesise organisational knowledge and automate multi-step work across Atlassian and connected third-party apps, using the Teamwork Graph.	confirmed	s3
perplexity	Out-of-the-box Atlassian agents integrate with Jira, Confluence and Jira Service Management.	confirmed	s2
perplexity	Out-of-the-box third-party MCP agents connect Atlassian to tools like Figma, Box and HubSpot and are enabled through Admin Hub.	confirmed	s18
perplexity	Custom agents are built in Rovo Studio with natural language and templates.	confirmed	s3
perplexity	Use case: turn Jira tickets into technical plans.	confirmed	s27
perplexity	Use case: automate repetitive work such as organising Jira issues, summarising meeting notes, updating project trackers and reviewing code.	confirmed	s28
perplexity	Use case: an agent that troubleshoots user issues.	confirmed	s29
perplexity	Atlassian performs safety screening on agents at its discretion for customer protection.	confirmed	s25
perplexity	App-based (Forge) agents only have access to data in the workspace where the app is installed.	confirmed	s25
perplexity	Rovo usage consumes credits, and admins can adjust settings and limits.	confirmed	s24
perplexity	Rovo is Atlassian's AI offering for personalised answers, automating tasks and smarter decisions using connected context.	confirmed	s3
perplexity	Rovo is powered by the Teamwork Graph, which maps relationships across people, apps, projects, code, decisions and assets.	confirmed	s3
perplexity	Rovo agents handle specific tasks and automate multi-step work across Atlassian and connected apps.	confirmed	s3
perplexity	Rovo agents can use data from Atlassian apps and connected third-party apps.	confirmed	s4
perplexity	Rovo is available across Atlassian apps, the browser extension and other work surfaces.	confirmed	s1
perplexity	To fully use Search, Chat, Agents and Studio, an Atlassian Cloud Standard, Premium or Enterprise plan is required.	confirmed	s1
perplexity	Rovo credits are Atlassian's unit for AI usage and enriched Teamwork Graph API access.	confirmed	s24
openai	Rovo agents are configurable AI teammates that retrieve information from Atlassian and connected apps and, where permitted, act in those systems on the user's behalf.	confirmed	s2
openai	Agents can be accessed in Chat, automation rules, within Jira and Confluence via shortcut commands, and in Studio.	confirmed	s2
openai	Skills are reusable instructions for work-based actions such as creating work items, drafting status updates or analysing incident data.	confirmed	s6
openai	Skills include MCP tools once a third-party MCP server is connected and approved for the site.	confirmed	s6
openai	Tools let an agent act outside an Atlassian app when connected, with the user's confirmation.	confirmed	s7
openai	Forge developers can publish tool modules for user-created agents, visible to the organisation or on the Marketplace.	confirmed	s7
openai	In automations agents act using permissions granted by admins.	confirmed	s14
openai	The Rovo MCP server limits external AI tools by admin-authorised domains, allowed actions (read, write, search), user permissions and optional IP allowlists.	confirmed	s22
openai	Third-party agents can call Rovo through Agent2Agent only when an org admin enables it, within data the user may view.	confirmed	s22
openai	Agents access data depending on their knowledge sources and respect user permissions, with no cross-site access for unauthorised users.	confirmed	s8
openai	Admins can control an agent's knowledge scope, for example unit-wide scope versus specific sites.	unverified
openai	Rovo agents are powered by LLMs from OpenAI and Google plus open-source models.	confirmed	s23
openai	Researchers reported prompt-injection paths that could exfiltrate Jira and Confluence data via Rovo's retrieval tooling.	confirmed	s35
openai	A Reddit discussion reports a critical cross-user and cross-tenant compromise in Rovo.	unverified
gemini	Rovo agents automate repetitive tasks across Jira, Confluence and connected tools, such as triaging tickets and summarising content.	confirmed	s5
gemini	ResearchAgent conducts multi-source web research and navigates arbitrary sites.	confirmed	s32
gemini	ResearchAgent can reach internal data in Jira, Confluence and connected SaaS tools.	confirmed	s33
gemini	Custom agents triage tickets, draft release notes, manage backlogs, generate OKRs and review code.	confirmed	s5
gemini	Engineering use case reaches source code in Bitbucket or GitHub and incident alerts in Opsgenie.	not-found
gemini	IT service management use case reaches JSM tickets, knowledge base articles, incident history and SLA status.	not-found
gemini	RovoBlast and prompt-injection vulnerabilities could exfiltrate Jira, Confluence and connected-app data; disclosed August 2026.	confirmed	s35
gemini	Rovo is powered by the Teamwork Graph, which maps relationships across people, apps, projects and code.	confirmed	s3
gemini	Rovo agents inherit the human user's permissions and can only see and act on what that user can.	confirmed	s10
openrouter	Rovo combines search, chat and configurable agents invoked from chat, automation rules and the editor, which can create or edit work items and pages when permitted.	confirmed	s2
openrouter	Jira Triage Agent reviews a work item and recommends field updates, duplicates and related items to link.	confirmed	s5
openrouter	Jira Coding Agent turns work items into code in a cloud sandbox and opens a pull request.	confirmed	s5
openrouter	Ops Expert supports incident management and on-call duties.	confirmed	s5
openrouter	An unnamed out-of-the-box agent moves work items into sprints, assigns them to epics and deletes old work items.	confirmed	s5
openrouter	Third-party MCP agents connect Rovo to services such as Figma or Claude.	confirmed	s5
openrouter	Forge developer example: a risk register assistant agent defined by a prompt and actions.	confirmed	s25
openrouter	Agents can trigger automation flows to create or update work items when criteria are met.	confirmed	s4
openrouter	Sprint closure can trigger a retrospective agent, and an epic moving to Done can create a Confluence page.	confirmed	s38
openrouter	Cprime case study: custom Rovo virtual agents for HR service inquiries with handoff logic.	confirmed	s39
openrouter	Jira Service Management has a virtual service agent for customer support.	confirmed	s2
openrouter	RovoBlast: a crafted rovoChatPrompt link exfiltrated Jira, Confluence and SharePoint data; remediated server-side on 8 July 2026.	confirmed	s34
openrouter	PromptArmor: hidden instructions in an uploaded document sent Jira and Confluence data to an attacker URL, even with web search off; published 5 August 2026.	confirmed	s31
openrouter	Disabling the web search toggle did not remove Rovo's URL-retrieval capability.	confirmed	s35
openrouter	No CVE was assigned and no exploitation of a live customer was reported.	confirmed	s35
openrouter	Atlassian says agents can be manipulated by malicious inputs, guardrail instructions are suggestions, and automation agents have no user to approve actions.	confirmed	s12
openrouter	Data leaving via third-party MCP servers is not covered by Atlassian's customer agreement commitments, and Atlassian does not guarantee their security.	confirmed	s19
openrouter	Skills are actions an agent is allowed to take, such as drafting a Confluence page or sending Slack messages; knowledge is the data it can reference.	confirmed	s4
openrouter	Agents can be configured with knowledge sources such as Confluence, Jira and Google Drive, plus deep research or web search.	confirmed	s2
openrouter	Admins can block Rovo for supported apps, disabling Agents and Chat, while Search, Chat and Create stay available if any Jira app on the site has Rovo.	confirmed	s21
openrouter	Turning off AI leaves search and Studio working, but Rovo Chat and agents become unavailable.	confirmed	s30
openrouter	A Rovo agent's actions depend on the user who triggers it, and Rovo searches only what that user can already access.	confirmed	s37
openrouter	By default everyone in an organisation can create agents, and admins can audit Rovo actions in an audit log.	confirmed	s37
openrouter	Rovo agents use models from OpenAI and Google plus open-source models; Chat adds Anthropic models via AWS Bedrock.	confirmed	s23
openrouter	Atlassian retains Chat and agent inputs and outputs for 30 days for safety and security, and its LLM providers do not retain them.	confirmed	s17
openrouter	Sources conflict on plans: one Atlassian page says agents need Premium or Enterprise, another that Rovo is on Standard, Premium and Enterprise.	confirmed	s30
openrouter	A compilation of Atlassian disclosures reports more than five million Rovo monthly active users and 2.4 million agent automations over six months.	confirmed	s35
openrouter	Rovo agents can be assigned Jira work items or tagged in comments, and in automation rules act asynchronously on app events or schedules.	confirmed	s25

The questions we would ask

We have not asked them yet.

PromptArmor reported in August 2026 that Rovo's URL-retrieval tool would open a URL the agent had composed, even with web search off: has that path been closed, and does the newer Web access toggle now govern every outbound request an agent makes, including Markdown images?
Your docs disagree on automated agents: one page says an agent in an automation cannot use its own tools, another that it can perform write actions directly. Which is current, and does an agent attached to a Jira workflow transition or board column ask anyone before it writes?
Can an organisation admin require every automated agent to run on its own agent account, so that no automation falls back to the builder's account and permissions?
Can a customer see, per agent run, every URL fetched and every piece of Atlassian content sent to a third-party MCP server, and export that record?
Guardrail instructions are described as suggestions: is there any enforced, non-prompt control that marks uploaded files, work item text or web content as untrusted before an agent can act on it?

Sources

s1 Rovo: Unlock organizational knowledge with GenAI | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/rovo
s2 Agents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/agents/
s3 What is Rovo? | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/rovo/guides/end-user-guide/what-is-rovo
s4 What are agents? | Rovo Studio | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/studio/docs/what-are-agents/
s5 Out-of-the-box agents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/atlassian-agents/
s6 What are skills? | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/what-are-skills/
s7 Add tools to Rovo agents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/agent-actions/
s8 Knowledge sources for Rovo subagents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/knowledge-sources-for-agents/
s9 What's the difference between a skill and tool? | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/whats-the-difference-between-a-skill-and-tool/
s10 Rovo agent permissions and governance | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/rovo-agent-permissions-and-governance/
s11 Understand Rovo agent accounts | Rovo Studio | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/studio/docs/understand-rovo-agent-accounts/
s12 Best practices to automate agents safely | Rovo Studio | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/studio/docs/best-practices-to-automate-agents-safely/
s13 Automate Rovo agents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/agents-in-automations/
s14 How to configure the Use agent action | Cloud automation | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/cloud-automation/docs/tips-to-configure-the-action-use-rovo-agent/
s15 Collaborate on work items with AI agents | Jira Cloud | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/jira-software-cloud/docs/collaborate-on-work-items-with-ai-agents/
s16 Rovo Chat capabilities | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/chat-actions/
s17 Rovo data, privacy, and usage guidelines | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/rovo-data-privacy-and-usage-guidelines/
s18 Out-of-the-box third-party MCP agents | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/out-of-the-box-third-party-mcp-agents/
s19 Rovo out-of-the-box third-party MCP agents usage guidelines | Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/rovo/docs/rovo-out-of-the-box-third-party-mcp-agents-usage-guidelines/
s20 Manage web access for Rovo | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/organization-administration/docs/manage-a-web-search-option-for-rovo/
s21 Manage Rovo access | Atlassian Support, Atlassian Support (docs, read 2026-11-07)
https://support.atlassian.com/organization-administration/docs/manage-rovo-access/
s22 Govern external AI access | Rovo MCP server setup guide | Learning - Atlassian Community, Atlassian Community (Atlassian Learning) (docs, read 2026-11-07)
https://community.atlassian.com/learning/lesson/govern-external-ai-access-with-the-rovo-mcp-server
s23 AI Transparency Notes | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/trust/ai/transparency
s24 Rovo Plans and Trial | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/licensing/rovo
s25 Rovo Agent (Forge manifest reference), Atlassian Developer (docs, read 2026-11-07)
https://developer.atlassian.com/platform/forge/manifest-reference/modules/rovo-agent/
s26 Atlassian Teamwork Graph, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/platform/teamwork-graph
s27 When to use Rovo | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/rovo/guides/end-user-guide/when-to-use-rovo
s28 How to use Rovo | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/rovo/guides/end-user-guide/how-to-use-rovo
s29 Build an agent that troubleshoots | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/rovo/use-cases/agent-troubleshooter
s30 Projects that practically manage themselves (Jira AI) | Atlassian, Atlassian (own-site, read 2026-11-07)
https://www.atlassian.com/software/jira/ai
s31 Atlassian Rovo Exfiltrates Data, Bypassing Controls (5 August 2026), PromptArmor (other, read 2026-11-07)
https://www.promptarmor.com/resources/atlassian-rovo-exfiltrates-data
s32 Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data (8 August 2026), SecurityWeek (press, read 2026-11-07)
https://www.securityweek.com/critical-one-click-vulnerability-in-atlassians-rovo-ai-exposed-enterprise-data/
s33 RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data, Varonis Threat Labs (other, read 2026-11-07)
https://www.varonis.com/blog/rovoblast
s34 Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers (8 August 2026), The Hacker News (press, read 2026-11-07)
https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html
s35 Atlassian Rovo Prompt Injection: Jira and Confluence Data at Risk (21 August 2026), Cloud Security Alliance AI Safety Initiative (other, read 2026-11-07)
https://labs.cloudsecurityalliance.org/research/csa-research-note-atlassian-rovo-prompt-injection-data-exfil/
s36 Is Atlassian Rovo safe to let act in Jira and Confluence? (29 September 2026), Greenlit Books field notes (other, read 2026-11-07)
https://greenlitbooks.com/field-notes/is-atlassian-rovo-safe
s37 Complete guide on how Atlassian's AI Rovo protects your data, Sngular (other, read 2026-11-07)
https://www.sngular.com/insights/442/complete-guide-to-privacy-and-permissions-in-atlassian-rovo-data-and-agent-security
s38 Atlassian Rovo Agents: A Practical Guide for Project Managers, Devoteam (other, read 2026-11-07)
https://www.devoteam.com/expert-view/atlassians-rovo-agents/
s39 Atlassian Rovo Agents: Your New AI Teammate, Cprime (other, read 2026-11-07)
https://www.cprime.com/blog/get-started-with-atlassian-rovo/

X-rayed by RiskMandate, which measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record (riskmandate.ai/llms.txt). The mandates are illustrative. Built by xray@web-summit.dinis from data/xray/atlassian/xray.json.