An issue often holds the only written trace of a decision
A Jira issue often holds the only written trace of a technical decision. Why this library rather than another, why a temporary workaround became permanent, what the client had actually asked for before someone rephrased it. The decision sits in a comment, six months down the page.
An AI that does not read those comments will suggest redoing what has already been tried. That is the kind of loss nobody measures, because it looks like ordinary work.
An issue's security level wins over the project's permissions
Jira has two permission layers that can contradict each other, and that is exactly where a naive connector leaks. The first layer is the project's browse permission, which says who can see the project's issues. The second is the security level set on a specific issue, restricting it to a few named people, groups or roles.
Inheriting the first layer alone would be a leak. A security incident, a dispute file or an issue tied to someone's departure lives inside a broadly accessible project, and it is the security level that protects it. The connector therefore always applies the narrower layer: when an issue carries a security level, its members decide, and the project no longer counts.
Every membership list is walked to its last page. When a group cannot be expanded, or when a page of results leaves any doubt as to whether it was complete, the issue is filed nowhere and waits for an administrator. A doubt about a permission list is not resolved by guessing the end of the list.
An issue in three fields
The connector asks Jira for six fields only. Anything outside that list is not filtered after reading, it is never requested.
A security level is read as a permission rule, never as content. It serves to decide who may read the issue, and its name does not appear in what the AI receives.
The five cases where an issue waits for an administrator
None of these cases produces a visible error for your teams. The issue is simply read by nobody until someone decides, and the decision is recorded.
- The project can be browsed without an account, so its real audience cannot be defined.
- A role or group named in the permissions could not be expanded into people.
- One of the named people cannot be identified in your organisation.
- The people allowed to read span more than one department.
- A membership list came back truncated, with no way to know whether a page was missing.
Every pass rereads every accessible issue
This is an engineering choice that costs real money and that we stand by. Jira does not touch an issue's updated date when its permissions change. Adding a security level, removing a role or editing a group therefore leaves no trace at all in the feed of recently updated issues.
Filtering on the updated date would be faster, and would miss exactly the reshares, which are the one thing this connector has to catch. So every pass lists every accessible issue again and recomputes its scope. An issue whose text has not moved costs nothing to review, and an issue whose permissions have moved gets refiled.
What this connector does not do
It does not work inside Jira. No issue is created, commented, transitioned or closed, and the transport it uses exposes no write method at all. A connected AI can tell you what an issue holds; it cannot move it forward.
It ignores your custom fields, and on a mature Jira that is often where half the method lives. The six fields requested are the ones carrying the text of the decision, not your management model.
Rereading everything on every pass makes the refresh heavier than with a source able to say what moved. That is the price of a scope that follows reshares, and we pay it rather than let a restricted issue surface for a department no longer entitled to it.
Install the free core and check it on a restricted project.
Kastel's core is free to self-host, with every connector. The most telling test is also the shortest. Put a security level on an issue, then ask for that issue through an AI working for someone who is not entitled to it.
Read the connection guide
