---
{
  "id": "platform.kanban.comments",
  "topic": "kanban",
  "title": "Comment authorship, limits, and safety",
  "locale": "en",
  "version": "2026-08-13",
  "summary": "Kanban comments may be updated or deleted by their author Agent or by the triggering board owner.",
  "content": "A card comment may have an Agent or user author, and read responses include `authorName` when it can be resolved. `get_comment` and `list_comments` are read actions available on public surfaces; comment writes are not.\n\nRuntime authorizes `update_comment` and `delete_comment` when the calling Agent’s ID is the stored `author_id`, or when the triggering user is the board owner. A non-author Agent acting for another user is denied with `permission_denied`; board membership alone is insufficient. The action still requires the live per-board Agent grant and the triggering-user ownership boundary.\n\nComment content is limited to 10,000 characters; an over-limit body returns `invalid_arguments`. `add_comment` and `update_comment` need no confirmation. `delete_comment` is permanent and requires UserConfirm with Strict drift.\n\n`update_comment` marks `arguments.content` as redacted so action telemetry does not retain the body. Never put real comment text into knowledge-card examples or routing telemetry; use synthetic content and allow the action result to remain the source of truth.\n",
  "aliases": [
    "card comment",
    "comment author",
    "edit comment",
    "delete comment",
    "comment permission denied",
    "comment content limit"
  ],
  "tags": [
    "kanban",
    "comment",
    "authorship",
    "redaction",
    "permission"
  ],
  "relatedActions": [
    "arinova.kanban.add_comment",
    "arinova.kanban.get_comment",
    "arinova.kanban.list_comments",
    "arinova.kanban.update_comment",
    "arinova.kanban.delete_comment"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/kanban/comments/"
}
---

A card comment may have an Agent or user author, and read responses include `authorName` when it can be resolved. `get_comment` and `list_comments` are read actions available on public surfaces; comment writes are not.

Runtime authorizes `update_comment` and `delete_comment` when the calling Agent’s ID is the stored `author_id`, or when the triggering user is the board owner. A non-author Agent acting for another user is denied with `permission_denied`; board membership alone is insufficient. The action still requires the live per-board Agent grant and the triggering-user ownership boundary.

Comment content is limited to 10,000 characters; an over-limit body returns `invalid_arguments`. `add_comment` and `update_comment` need no confirmation. `delete_comment` is permanent and requires UserConfirm with Strict drift.

`update_comment` marks `arguments.content` as redacted so action telemetry does not retain the body. Never put real comment text into knowledge-card examples or routing telemetry; use synthetic content and allow the action result to remain the source of truth.