We found out recently that a client user of our JSM product can read and add internal comments intended for our team only.
The user needs to be able to see all tickets for their company (they can), whether they created them or not, but should NOT be able to read or create internal comments. In this screenshot, you can see that the user created the original ticket, and was able to add an internal note. He should be able to reply to the previous comment, but only publicly.
