Contact usGet started

AI product guidance

Rovo governance guidance

How to govern Atlassian Rovo across Jira, Confluence and connected apps, including agents and automations, with guidance for executives, risk teams and IT.

How should an organisation govern Rovo?

Rovo pays off when it is governed as an ongoing practice rather than approved once at launch. Three things matter whatever the role. The first is knowing everything that is in use, including every agent, automation and connection, and who is accountable for each. The second is keeping access, agent identities, controls and assessments in step with a deployment that keeps growing. The third is being able to show, at any time, how decisions were made and that controls held. Organisations that get these right can extend Rovo further and faster, with confidence rather than caution.

Reviewed 3 October 2026. Aicura is not affiliated with Atlassian.

About Rovo

Rovo brings AI into Jira, Confluence, Bitbucket and the other Atlassian apps, helping people search, ask questions, summarise work and draft content across the organisation’s own knowledge. Its reach grows over time. Connectors bring in content from dozens of other business applications, agents take actions in Atlassian and third-party tools, automations run agents without anyone watching and developer tools work directly in code and on developer machines. Good governance lets an organisation take up each of these with confidence and keep oversight in step as the deployment grows.

Where governance makes the difference

  • Information reaching wider than intended. Rovo works with what each person can already see, across Atlassian apps and every connected application. Where sharing in any of those tools is broader than intended, Rovo can bring that content into everyday answers.
  • Agents acting without a person in the loop. Agents placed in automations can create, update and route work unattended. An agent with broad access and no clear owner can take actions nobody set out to allow, at the pace of the workflow it sits in.
  • Content steering an agent. An AI agent follows instructions in what it reads, so a ticket, page or message written outside the organisation can influence what an agent does with internal information.

For the executive team

The value depends on getting access right first

Rovo draws on everything each person can open, in Atlassian and in the other business tools connected to it. Most organisations have some sharing that is broader than it needs to be, and that matters more once an assistant can search all of it at once. Tidying access before switching on connections and wide use lets the organisation get the benefit without surprises.

Every agent needs an owner and a purpose

Agents can raise and route requests, update work and send messages on the organisation’s behalf, and some run inside automated workflows with no one reviewing each step. Each agent needs a named person accountable for it, a clear purpose and agreed limits on what it can reach and change.

Work that affects people deserves a closer look

Rovo can route service requests, summarise work and draft content about colleagues and customers. Where its output shapes how someone is treated or whether they get a service, the organisation needs to know where that happens and who checks it.

Oversight needs to keep pace with change

New agents, new connections, new tools and new capabilities arrive regularly, and teams can build their own. The deployment approved at launch will not be the one running six months later, so oversight works best as an ongoing practice rather than a one-off sign-off.

Questions worth putting to management

  • Who is accountable for Rovo, and who owns each agent and automation built on it?
  • Is there a complete picture of every agent in use, what it can reach and which ones run unattended?
  • Which other business applications are connected to Rovo, and who approved each connection?
  • Where does Rovo output influence decisions about staff or customers, and who reviews it?
  • How would the organisation know if information reached the wrong people or an agent went beyond its purpose?
  • If a regulator, customer or insurer asked how Rovo is governed, what would be shown to them?

What good reporting looks like

Expect regular reporting on where Rovo and its agents are in use, which applications are connected, the main risks and how they are changing, any incidents or near misses and the significant decisions taken, with who made them and why.

How Aicura can help

  • One place showing Rovo, every agent and connection built on it, who owns each one and what it can reach.
  • Board reporting drafted from the governance record, covering use, risks, incidents and the decisions taken.
  • A public trust centre where customers, partners and regulators can see how the organisation governs its AI, backed by evidence a third party can verify.

For risk, compliance and assurance

Set where Rovo sits in the risk appetite

Decide which classes of information Rovo may work with and which decisions its output may inform. Output that feeds decisions about people, such as request routing, performance or customer outcomes, needs review by someone who knows the subject before it is relied on.

Assess the deployment, each connection and each agent

Assess the Rovo deployment as a whole before rollout, covering where sensitive information sits across Atlassian and connected applications and who can reach it. Assess each connector before it is switched on, since it brings a whole new body of content within reach. Assess each agent on its own terms, covering the data it reaches, the actions it can take, whether it runs unattended, whose identity it acts under and who reviews its output.

Reassess when anything changes

A new agent, connector, tool or capability or a change to the underlying AI all move the deployment away from what was assessed. Each needs to trigger a fresh assessment rather than wait for the annual cycle.

Make the data decisions explicitly

Decide whether Rovo may draw on public web search, and for which teams. Decide whether the organisation takes part in the vendor’s data contribution programme and at what level, after reading how it works. Decide whether data residency is needed for in-scope content. Check how long the vendor keeps chat and agent interactions and how connected content is handled when a connection is removed, and make sure those periods fit the organisation’s own retention rules.

Confirm which protections apply

Check the vendor’s published commitments on how AI providers handle submitted data and confirm they cover the plans and features the organisation actually uses. Each connected application and each third-party tool an agent uses brings its own terms, so check those too. Work done in AI tools on personal accounts sits outside these arrangements, so find that use and bring it into the approved setup.

Set limits and name who acts

Agree the limits that matter, such as an agent acting outside its usual pattern, an automation running far more often than expected, sensitive information appearing in prompts or a sudden change in use. Name the person who acts when one is crossed.

Be ready to show governance to others

  • Policy. Maintain an AI use policy that covers Rovo specifically, including what may be entered into it, who may build and share agents, when agents may run unattended and how output affecting people is reviewed. Tie each commitment to the control that carries it out.
  • Accountability. Record committee and management decisions with their reasons when they are made. Have agent owners confirm periodically that their agents still match what was approved.
  • Operating evidence. Keep records that controls actually ran, such as completed access reviews, connector and agent approvals, reviewed outputs and interventions.
  • External scrutiny. Prepare for internal and external audit, certification against standards such as ISO/IEC 42001, regulator enquiries and insurer questions about AI controls.
  • Customers and partners. Service desks built on Atlassian often handle customer requests directly. Have the Rovo answer to due diligence questionnaires ready and supported by evidence.
  • Incidents. Be able to reconstruct which agent version, which identity, which data, which prompt and which controls were in place at the time.

How Aicura can help

  • Risk and impact assessments against recognised frameworks that run again whenever an agent, connector or capability changes, feeding a managed set of risks and controls that can mirror to the GRC platform.
  • Requests for new agents and connections routed to the right approvers, with committee decisions and owner attestations recorded against the systems they concern.
  • Connections to data catalogues and privacy platforms that show which data Rovo and its agents reach and flag where that breaks the organisation’s own data rules.
  • Every decision and control action kept as evidence that can be verified without relying on the organisation’s word.

For technology and security

Discover every form Rovo takes

Inventory Rovo across each Atlassian app, every out-of-the-box, custom and partner agent, every automation that calls an agent, every connector and external tool server and the developer tools in the terminal, IDE and code review. Include the desktop app, browser extension and chat app integrations on managed devices in the same picture.

Prepare information access before connecting anything

Start with permissions in Atlassian and in every application due to be connected. Find the spaces, projects and shared drives most likely to hold sensitive content and tighten access where it is broader than needed. Use the vendor’s options to keep specific content out of the index for connected file stores, and block Rovo in apps where it is not yet wanted. Roll out connectors in stages, starting with sources whose access has already been reviewed.

Choose the identity each agent acts under

An agent can act as the person using it, with all of their access, or under its own agent account with access granted by administrators. Use agent accounts for anything automated so the agent holds only the access its task needs and its actions are attributed to it. Set default access for new agents narrowly and widen it per agent with a reason.

Control who can build, share and extend agents

Limit who can create agents, apps and automations, and keep a review step before an agent is shared widely. Give each agent only the tools its purpose needs and restrict automated agents to read-only actions wherever they do not need to change anything. Decide which external tool servers and third-party actions are allowed at the organisation level rather than leaving it to each builder.

Put change under control with preflight checks

New agents, tools, connectors and automations are the points where Rovo’s behaviour changes. Route each through a request and approval step, and where agents and tools are delivered as custom apps through a deployment pipeline, run a preflight check on every deployment so they are checked against agreed rules before they go live.

Govern the traffic that can be reached

Rovo’s own processing runs in the vendor’s cloud, so its calls to AI providers sit outside the organisation’s request path. Traffic from managed devices to the vendor, including from the developer tools, can pass through a gateway or proxy at the network edge to allow, block, log and meter it, keeping use to the approved organisation and away from personal accounts. Where the organisation’s own agents and AI clients reach Atlassian data through its tool server, their model calls sit in the organisation’s own request path. Route those through an AI gateway to redact personal information, screen inbound content for injected instructions, restrict tools and models, cap spend and stop an agent when needed.

Treat developer tools as agents on the device

The command-line developer tool can run shell commands and change code on a developer’s machine, and can connect to other tool servers. Set its tool and approval settings centrally where possible, limit which external tool servers it may use and keep it out of repositories and environments that hold secrets it does not need.

Feed everything Rovo exposes into monitoring

Bring the administrative records, agent activity attributed to agent accounts and usage information the platform exposes into monitoring alongside device and network telemetry. Apply the limits risk has agreed and set responses ranging from alerting the owner to narrowing an agent’s access or switching it off.

Test agents against the live deployment

Red-team and evaluate custom agents before release and on a schedule afterwards, especially those that read content from outside the organisation or run in automations. Test against the deployed agent with its real tools, identity and data and watch for changes in behaviour between tests.

How Aicura can help

  • One inventory of Rovo, its agents, connectors, tools and agent identities, with discovery of AI use on devices and in code repositories that is not yet recorded.
  • Preflight checks in the deployment pipeline before a custom agent, tool or app goes live, with every answer recorded.
  • A gateway in the request path for the organisation’s own agents and AI clients that reach Atlassian data, covering redaction, injection screening, tool and model limits, budgets and the ability to stop an agent.
  • A collector inside the network for telemetry and activity records that flags tool calls an agent was never declared to make, plus scheduled red-teaming and evals against the live deployment.

Getting lasting value from Rovo

Rovo pays off when it is governed as an ongoing practice rather than approved once at launch. Three things matter whatever the role. The first is knowing everything that is in use, including every agent, automation and connection, and who is accountable for each. The second is keeping access, agent identities, controls and assessments in step with a deployment that keeps growing. The third is being able to show, at any time, how decisions were made and that controls held. Organisations that get these right can extend Rovo further and faster, with confidence rather than caution.

Sources

More AI product guidance

Related guides

In the platform

Register Rovo with the rest of your AI

Aicura's AI register and discovery are free to start. Register Rovo from a catalogue of known AI products, give it an owner and find the AI nobody has registered yet.

Sign upContact us