Concourse & Jira Cloud Portal
After speaking with the Jira team and my cyber colleagues, I learned that individuals with "full" access would be able to delete all comments and attachments in Jira, whereas limited access could only add a comment or delete their own comments and attachments.
We also need to enforce more controlled access controls. Only Managers and above should be allowed to have full access. An user should not be able to change their access from limited to full.
Thanks for this feedback! We're reassessing our roles and permissions matrix. We'll take this feedback into consideration as we conduct research and propose a final solution.