Sentinel Vault's no-key Confluence AI review rests on a four-line Forge manifest

Forge LLMs is what lets a model call stay inside the Runs on Atlassian badge. Atlassian's announcement says apps using it "can qualify for Runs on Atlassian because app data stays contained within Atlassian cloud the entire time" ^[10]. The API reference says the same thing from the developer's side: "The app retains its Runs on Atlassian eligibility after the module is added." ^[11]

Sentinel Vault's declaration in manifest.yml names one module, `sentinel-vault-llm`, and one model family, `claude` ^[13]. The authors grepped the manifest for a `remotes` section and for an external permissions block. Both searches came back empty ^[13].

I think the strongest part of the design is who decides the badge. "The Runs on Atlassian badge is automatically applied to eligible apps on the Atlassian Marketplace," Atlassian's program page says, and the post notes that Atlassian makes that call from the deployed app ^[6]. A vendor cannot add the badge by editing its own listing.

The pitch says no external data egress is declared ^[1]. The program rule allows more than that: "Your app must not egress data, with the exception of egress for analytics purposes." ^[5] The requirements leave analytics and logs to admin controls ^[4]. So an admin reading the pitch should still check those controls.

Atlassian's program page also says where its guarantee stops: "While controls that limit external data egress are in place, these controls do not prevent misuse of access granted to the app during installation or abuse of the app runtime." ^[8] The post's author wrote: "The badge tells you where the data can go. It doesn't tell you the app uses its permissions well." ^[17]

For Sentinel Vault, that granted access is four things. It has Confluence scopes, a content-styles entry, read-only JSM Assets scopes used to import classification levels, and app storage ^[14]. None of them is an external fetch permission ^[14].

Requests to the model also go through Atlassian's own filter. They get the same moderation checks as Atlassian's first-party AI and Rovo features, and the filter blocks messages the Acceptable Use Policy rates high-risk ^[12].

Forge's `forge eligibility` command tells a developer whether a deployed version qualifies. The authors ran it against both environments on 1 October ^[15]. The record ends at that command. Its output is not there, and neither are the cost-ceiling explanation and the four weak points the post promises ^[19].

On where the data goes, I'd accept a manifest with no remotes plus a badge that Atlassian assigns itself. On how the app uses its access, Atlassian's caveat leaves the review with the admin ^[8].