# Limits of Attio for Jira A security review, or an administrator deciding whether to install this at all, gets to an answer faster from the list of things an app cannot do than from the list of things it can. This page is that list. It is also the page to read when something looks broken. A panel that is not there at all, and a picture that never loads, are both most often the app behaving exactly as designed. ## It does not write | **System** | **What the app writes** | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Attio | Nothing at all. Every call is a read, and the app holds no permission to write. It identifies the key, lists the workspace's objects, reads an object's attribute definitions, and queries records to find a match and to resolve links. There is nothing in the app that creates, edits or deletes a record. | | Jira | One small non-secret flag on the project, holding whether the project is ready or disconnected and which placements were chosen. That flag is what lets Jira hide the card on projects that have not finished setup. It holds no workspace name and no record type, because anything stored on a project can be read by anyone who can browse it. | The app asks Jira for no permission to create, edit or delete anything. It never writes to your issues, never comments, and never sets a field. Resetting a project changes nothing inside Attio either: a key you no longer want has to be revoked in Attio separately. ## It does not copy your CRM * No background sync, no schedule, no queue. Values are fetched when somebody opens a request. * No attribute an administrator did not choose is sent to the browser. Unselected attributes, on the record and on the records it links to, do not leave the app. * The reporter's email address is never displayed, never logged and never stored in readable form, on any screen or in any message. Every sentence says "this reporter". * When a project matches by domain, the domain itself is not logged either, only whether a match was found and how many candidates there were. ## Things the card does not have * No title, no heading, no record name at the top and no workspace name. The card is the attributes chosen, in the order chosen, with one "Open in Attio" button at the bottom left. The record's own name appears only if somebody put that attribute on the card. * No "last updated" line, and no refresh control on a working card. * No way to pick a candidate when several records match. The card lists up to three and tells you to go and disambiguate in Attio. * No per-person hiding of individual attributes. Everyone who passes the audience gate sees every attribute chosen. * No scrolling and no height of its own. The card grows and the Jira surface around it handles the rest, and a wide row never produces a horizontal scrollbar inside it. * No truncation. Long values are folded visually with "Show more", and every character stays on the page. * No resolution of Attio workspace members to a person's name. An attribute holding an owner or a creator reads "Workspace member", or "Attio" where it was Attio's own automation. ⚠️ **A text attribute holding a picture address is shown as a link, not a thumbnail.** Putting Attio's own avatar or logo attribute on the card gets you the full address as a clickable link wrapped over several lines. The way to show the picture without the address is to nominate that attribute with its Image button on the Fields screen and leave it off the card. ## Things the settings screens do not have * No rendered preview of the card. Previewing is a real value beside every attribute row, plus a small linked-record card and the customer's picture inside the value column. Neither screen draws the card as an agent will see it. * No search and no filter on the attribute list. Attributes are split into what is on the card and everything else, and an object with many of them has to be scrolled. * No Cancel in the setup wizard. A project in setup has Back and Next. * No key-only disconnect. Reset to defaults is the disconnect, and it takes the rest of the configuration with it. * No site-wide key and no site-level connection. The site-wide connections list is read-only: it cannot enter, reveal, rotate or clear a key, because keys belong to the project that pasted them. * No OAuth sign-in and no Attio app to install. The connection is one workspace API key, pasted per project. ## Where it does not appear * Not on business or software projects. The app adds nothing there at all, including no settings entry. * Not for anonymous or unlicensed viewers, and never on the customer portal. * Not for a viewer without Jira Service Management agent features, whatever the Permissions tab says. * Not for anyone who cannot open the request as themselves. That floor cannot be configured away. * Not on a project that has picked placements but cannot yet resolve a record. Placements only take effect once there is a key, an object, a matching attribute and at least one attribute on the card. ⚠️ **Two situations render nothing at all.** A viewer outside the audience gets no card and no message, because saying "you cannot see this" is itself information about the customer. An agent on a project whose setup is unfinished also gets nothing: only a project administrator is told which piece is missing. A missing panel is therefore not on its own evidence of a fault. ## What it will not tell you * Which of the four company-matching dead ends happened. A reporter on free mail, an address with no domain, a domain no record holds and a domain too many records share all read as "No Attio record matches this reporter." * Why a reporter has no readable address. A hidden address and an absent one cannot be told apart, so the card says only "No email address is available for this reporter." and offers no reason. * Whose rate limit it was. The card's wording always names Attio, even where the slowdown came from Jira. * What Attio said. Error wording is always the app's own, never Attio's response, because an upstream message can quote the value that failed, and on the lookup that matters that value is the reporter's address. * The reporter's email domain. No message about a domain that could not be matched ever names it. ℹ️ **Nothing takes the card down.** A revoked key, an Attio outage, a rate limit, Jira not answering: each is answered with a sentence inside the card, so a failure never takes the card down and never hides the parts that did work. --- ## A few things worth knowing * "The panel is missing" is usually the audience gate or unfinished setup, both of which render nothing. Check as a project administrator on the same request before treating it as a fault. * A picture that will not load is silent by design: no spinner, no broken-image icon, no message, only coloured initials. A record with no usable picture is the ordinary case, so nothing is reported for it. * Reset to defaults changes nothing inside Attio. It removes what this app stored in Jira, and a key you no longer want stays live until you revoke it in Attio. --- ## Related [Attio for Jira settings and defaults](https://help.gocapable.com/attio-for-jira/attio-for-jira-settings-and-defaults.html) [How fresh the Attio card is](https://help.gocapable.com/attio-for-jira/how-fresh-the-attio-card-is.html) [Attio for Jira limits and caps](https://help.gocapable.com/attio-for-jira/attio-for-jira-limits-and-caps.html) --- _A short list of absences is worth more than a long list of features._