Approval Desk – Bulk Approvals for JSM — Security

1. Scope

This policy describes the security boundary for Approval Desk – Bulk Approvals for JSM, operated through Atlassian Forge in Jira Cloud.

2. Signed-in user authority

Approval inbox reads, request context and approval decisions use the signed-in Jira user's context. The server re-checks answerability and current approval state; hiding a button in the interface is not treated as a security boundary.

3. Tenant isolation

Configuration and bulk-operation records are stored in Forge Storage scoped to the Jira installation. Tenant identity comes from the Forge installation context, not from an arbitrary browser-supplied site identifier. The app has no external customer-data database or vendor-controlled data egress destination.

4. Permissions

Production permissions are limited to the documented JSM approval workflow:

• read:jira-user — display authorised approver and requester names.
• read:jira-work — read authorised request context.
• read:servicedesk-request — read JSM requests and their visible fields.
• read:request.approval:jira-service-management — read approval state and answerability.
• read:request.status:jira-service-management — avoid presenting unavailable requests as actionable.
• read:requesttype:jira-service-management and read:servicedesk:jira-service-management — configure request types and service projects.
• write:servicedesk-request and write:request.approval:jira-service-management — record the signed-in approver's native decision.
• storage:app — store tenant configuration and minimal operation metadata.

5. Data minimisation

Request values, summaries, comments and attachments are not stored permanently by the app. Short-lived operation metadata is limited to what is needed to make bulk processing idempotent and show a trustworthy result. The app does not request passwords, API tokens, OAuth secrets or a service account.

6. Failure handling

Stale approvals, permission failures, rate limits and technical errors are surfaced as distinct states. Safe Bulk evaluation fails closed, duplicate submissions are guarded by an operation id and partial outcomes stay visible for follow-up.

7. Vulnerability disclosure

Report a suspected security issue privately using the support form with category Security, or email support@narrowforge.com with “Security – Approval Desk” in the subject. Do not include credentials, tokens or unnecessary personal data.

8. Certifications and contact

Approval Desk does not currently claim SOC 2, ISO 27001 or another formal security certification. If that changes, the scope and effective date will be stated here. For security questions, contact support@narrowforge.com.

Related: Terms of service · Privacy policy · Customer support

Last updated: 2026-09-09.