{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T01:25:58.088Z",
  "record_id": "VXI-EXT-PROCUREMENT-ATLASSIAN-APP-COVERAGE-01-v1",
  "record_kind": "external_reference",
  "title": "Atlassian app rules: Covered and exempt data",
  "system": "Atlassian app access rules",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does an Atlassian app access rule block every API data category?",
  "near_questions": [
    "Does an app access rule block every data category?",
    "What does exempt mean in an Atlassian API reference?",
    "Which operations are covered by the buyer rule?",
    "Can a blocked app still access exempt information?",
    "Does rule enablement establish complete app isolation?",
    "What evidence should an agent request for API coverage?",
    "Can a new app capability change the review scope?",
    "How should procurement record an uncovered data category?",
    "Does a denied content request settle metadata access?",
    "Which operation references should a saved review identify?",
    "Can I retain the app-rule coverage decision?",
    "When should an app access rule be reassessed?"
  ],
  "supported_claims": [
    {
      "claim": "Atlassian distinguishes covered data from exempt data in its API references. Rules can block covered data, while exempt categories are not blocked by those rules. Map the actual API operations and data categories before accepting a complete app-isolation claim.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Atlassian distinguishes covered data from exempt data in its API references. Rules can block covered data, while exempt categories are not blocked by those rules. Map the actual API operations and data categories before accepting a complete app-isolation claim.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-NOTION-INHERITED-SHARING-01-v1",
    "VXI-EXT-PROCUREMENT-SHAREPOINT-LINK-AUDIENCE-01-v1",
    "VXI-EXT-PROCUREMENT-DRIVE-FOLDER-INHERITANCE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Atlassian app access rule coverage and exempt data",
    "source_url": "https://developer.atlassian.com/cloud/jira/platform/data-security-policy-developer-guide/",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-ATLASSIAN-APP-COVERAGE-01-v1",
    "candidate_record_sha256": "8f686046964728522cd23fb37134e1d5f5645f815672ad49427ecde45b0a2790",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Atlassian distinguishes covered data from exempt data in its API references. Rules can block covered data, while exempt categories are not blocked by those rules. Map the actual API operations and data categories before accepting a complete app-isolation claim.",
    "required_buyer_context": "Atlassian app, rule scope, target content and API operations.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "An app access rule blocks every kind of data the app can retrieve.",
    "documented_statement": {
      "status": "documented",
      "statement": "Atlassian distinguishes covered data from exempt data in its API references. Rules can block covered data, while exempt categories are not blocked by those rules. Map the actual API operations and data categories before accepting a complete app-isolation claim.",
      "source_ids": [
        "atlassian-access"
      ]
    },
    "buyer_evidence_required": [
      "Active rule and protected content scope",
      "Coverage or exemption status for the relevant API operations",
      "Other access paths and app permissions in the buyer deployment"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require operation-level coverage evidence before claiming complete isolation."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "atlassian-access",
        "url": "https://developer.atlassian.com/cloud/jira/platform/data-security-policy-developer-guide/",
        "final_url": "https://developer.atlassian.com/cloud/jira/platform/data-security-policy-developer-guide/",
        "title": "Atlassian app access rule coverage and exempt data",
        "checked_on": "2026-10-14",
        "sha256": "fc40465747056d45fd7f3ed242b7e51947c798ce91843fa9a2952aae1022e0cf",
        "bytes": 302384
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the covered-versus-exempt distinction for an app procurement review.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck API coverage references and app capability changes."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#atlassian-app-rule-exemption-evidence",
  "machine_readable_record": "/varexis-index/records/atlassian-app-rule-exemption-evidence.json"
}