About using Rovo Agents

[Lucas Oliveira]

From what I gather, the agent doesn't seem fully assertive, since even when the instructions are changed, it can still pull in information beyond the specified data source. While it does check user permissions, the issue is that the agent can still share text-based information even when the user isn’t allowed to access the original content. The user just can't open the actual page, but they still receive details from it — which defeats the purpose if we want to enforce strict access controls.

During my tests, I also noticed that users can get information from restricted Confluence spaces by simply asking other Rovo agents in the company, even if they don’t have access to that space themselves.

Another point is that there doesn't seem to be any restriction on who can access the agents themselves — it looks like everyone in the company can find and use any agent that’s been created.

Is there any official place where we can suggest improvements or share feedback?
Right now, the agent’s behavior makes it hard to justify using it with a knowledge base if it doesn’t strictly respect the data boundaries — or if it exposes info to users who shouldn't have access to the source.

[Mia Tamm]

Hi @Lucas Oliveira ,

Thanks for sharing your detailed observations. As @Kian Stack Mumo Systems mentioned, the Rovo project page on Atlassian Jira is the right place to raise this. There’s already an open feature request to hide agents from users, but your point about agents returning text from restricted pages isn’t listed there and it’s definitely something Atlassian would want to review.

I’d recommend opening a separate ticket describing exactly what you’ve tested (without including sensitive data) so the team can confirm if this is intended behavior or a bug. That will also make it easier for others to track and vote on it.

— Mia Tamm from Simpleasyty

[Kian Stack Mumo Systems]

@Lucas Oliveira, welcome to the community! 

I would start by taking a look at the Rovo project on the Atlassain Jira. From a quick search, I actually see that there is an open feature request to hide agents from users. I didn't see anything about Rovo providing text from restricted pages, but that does sound like an issue Atlassian would want to be made aware of! I would submit a ticket in there as a bug or an improvement. 

Thanks, 

Kian