If you have a primary application link between JIRA in Confluence, users get a notification in their Confluence workbox everytime someone comments in a ticket the user is watching. Users receive the notification (with the text of the comment) even when the comment is restricted to other groups, disclosing the restricted information to users without enough permissions.