AI Transparency

Customer Portal Toolkit can use Atlassian-hosted Forge LLM for bounded summaries or explanations. AI is optional, administrator-controlled and not required for core portal content or actions.

What AI may do

Enabled AI widgets may create plain-language summaries or explanations from the bounded, authorized data supplied to that widget. Administrator-facing AI assistance may help draft supported configuration copy where present in the released version. AI does not independently publish configuration or execute Jira actions.

Controls and availability

• An authorized administrator must enable Forge LLM for the installation.
• Each customer-facing AI widget must also be enabled and configured separately.
• Core portal rendering, privacy controls and customer actions continue without AI.
• If AI is disabled, unavailable, over budget, times out, trips a circuit or returns invalid output, the App uses deterministic fallback or a safe unavailable state.
• Forge LLM is an Atlassian Preview service and may be limited, changed or withdrawn by Atlassian.

Input boundaries

Input is minimized to data already authorized for the current actor and required by the selected feature. Private comments, attachment contents, credentials, secrets and data from other customers' requests are prohibited from the AI input path. Request content is treated as untrusted data and separated from App-owned instructions. Administrators cannot replace system instructions with arbitrary prompts.

Model and provider

The App uses the Forge LLM API and currently declares the Claude model family supported by Atlassian. Atlassian controls the hosted model service, model availability, moderation, routing and any underlying model-provider relationships. The App does not call Anthropic or another model provider directly. Customers should review current Forge LLM documentation, Atlassian AI terms and Atlassian subprocessor disclosures for platform-level processing.

Output safeguards

Input/output sizes, budgets, timeout, retries and circuit behavior are bounded. Output is parsed through a strict schema, checked for unsafe markup/links and unsupported commitments, length-limited and labeled before display. These controls reduce risk but do not guarantee accuracy or suitability.

Storage and logging

• Validated AI output may be cached in installation-scoped Forge storage for up to 15 minutes using tenant, principal, configuration, source and locale dimensions.
• Content-free usage aggregates such as token/result counts may be retained for 180 days.
• Supporting execution leases last up to 30 seconds and circuit state up to 20 minutes.
• The App does not log full prompts or completions.
• Mederak Apps does not receive AI input or output in a vendor-hosted backend.

Atlassian controls service-level retention, moderation and infrastructure logs for Forge LLM. We do not make an independent claim about model-provider training or platform retention beyond Atlassian's current official terms.

Appropriate use

AI output may be inaccurate, incomplete, biased or outdated. Users must verify operational facts in Jira or with the responsible service team. Output must not be treated as authoritative Jira state, an SLA guarantee, or the sole basis for legal, employment, security, financial, medical, safety or similarly high-impact decisions.

Administrator responsibilities

Before enabling AI, administrators should assess privacy, policy, residency, language, project suitability and Atlassian Preview terms; test with authorized data; confirm fallback behavior; and inform users where required. Questions can be submitted through Mederak Apps Service Desk.