Every new Jira Cloud comment is "Viewable by All Users" unless someone remembers the lock icon. Atlassian's request for a default (JRACLOUD-9091) sits at 990 votes and is still "Gathering Interest". If your projects include clients or contractors, one forgotten click leaks an internal note.
What actually works today:
- Click the lock every time. Free, error-prone.
- Automation rule that re-restricts after posting. The rule actor must be a real user in the target role (Atlassian treats the Automation user not joining roles as expected behaviour, JSWCLOUD-22454). Notifications go out before the fix.
-
REST API
POST /rest/api/3/issue/{key}/commentwith avisibilityobject. Atlassian's own KB workaround for team-managed projects (JRACLOUD-83171). - Use JSM if you can: it has real internal vs. reply-to-customer comments.
I build small Forge apps under the name Loomwise, and wrote a free one for this: Loomwise Private Comments restricts new comments to a role or group you choose per project, and runs entirely on Atlassian (Forge, no data leaves your site). Full guide and install: https://loomwise.app/jira-private-comments/
Questions or edge cases: hello@loomwise.app.
