v0.12.122: @newsroom.writer: what can your agent reach?, corrected from ChatGPT's review

What can your agent reach? was reviewed by ChatGPT at Dinis's request. Every point was checked against Atlassian's and RiskMandate's own pages before changing anything, and all fifteen findings are fixed. The review is on the record, at the foot of the article and on the reviews hub, with an answer to each finding.

The main correction is whose permissions a Rovo agent uses. The agent's creator does not pass on their access. The executing identity is:

• the person asking, in chat;
• the account on the automation's connection, in an automation;
• the agent's own account, if it has one, in which case anything shared with the agent is shared with its users.

The ROVO-837 case is described exactly: a link to a restricted page reached a ticket; the page itself stayed closed.

Also corrected:

• connector setup by type;
• creating an agent and using an agent as separate controls;
• audit logs as evidence, not a barrier, and classification as a barrier only through a policy;
• the scope of indexing allowlists and of the MCP switches;
• the PromptArmor report as historical, with its current status unverified;
• prevalence claims replaced by "measure it per deployment";
• "policies for commercial agents", not integrations;
• RiskMandate's top two levels as "specified, never run";
• the Ruflo enforcement scoped to the adapter;
• the Northstar figures as a scripted simulation;
• the UK Corporate Governance Code's scope.

A five-step check for a real Rovo deployment is added.

Two points in the review itself did not hold when checked. Its quotation of an Atlassian support article on automation connections was not found on Atlassian's pages, so the article quotes ROVO-837's equivalent wording instead. And "This issue does NOT occur in Rovo Chat" is the reporter's sentence, not Atlassian's. Both are noted in the record.

Series. The series bar now reads Generation Z Developers (AI edition).