Rovo Agent Can Log Time on Behalf of Others and Into Closed Periods

Problem

A custom-built Rovo agent, which is used to log time, can post time to periods Tempo has already closed and log time on behalf of other users, even without the "Log Work for Others" permission. The affected user's Tempo timesheet also doesn't immediately reflect these entries.

Solution

This can happen when the agent writes worklogs directly to Jira's native API instead of going through Tempo, bypassing Tempo's closed-period and permission checks, which only run inside Tempo (not Jira). You can confirm this on the work items History tab: worklogs synced from Tempo show the author as "Timesheet by Tempo - Jira Time Tracking," while those written directly to Jira show the real user's name.

You’ll want to consider using Tempo's official Worklog Assistant Rovo agent instead. It logs time through Tempo, so it correctly enforces closed periods but can only log time for the current user.
See: https://help.tempo.io/timesheets/latest/timesheets-worklog-assistant.

Any custom or third-party integration that writes worklogs directly to Jira will bypass these Tempo rules by design; there's no supported workaround other than routing time entry through Tempo.