Comment authorship, limits, and safety

A card comment may have an Agent or user author, and read responses include authorName when it can be resolved. get_comment and list_comments are read actions available on public surfaces; comment writes are not.

Runtime authorizes update_comment and delete_comment when the calling Agent’s ID is the stored author_id, or when the triggering user is the board owner. A non-author Agent acting for another user is denied with permission_denied; board membership alone is insufficient. The action still requires the live per-board Agent grant and the triggering-user ownership boundary.

Comment content is limited to 10,000 characters; an over-limit body returns invalid_arguments. add_comment and update_comment need no confirmation. delete_comment is permanent and requires UserConfirm with Strict drift.

update_comment marks arguments.content as redacted so action telemetry does not retain the body. Never put real comment text into knowledge-card examples or routing telemetry; use synthetic content and allow the action result to remain the source of truth.

Related actions

arinova.kanban.add_comment, arinova.kanban.get_comment, arinova.kanban.list_comments, arinova.kanban.update_comment, arinova.kanban.delete_comment

Also known as

card comment, comment author, edit comment, delete comment, comment permission denied, comment content limit

---

Machine-readable Markdown · Knowledge index