Who can view and edit each space and page, and why.

Click Take a snapshot (Take a new snapshot after the first). The app lists every space and reads its permissions, lists every group, looks through every page and blog post for view and edit restrictions, then reads the members of each group named by a space permission or a restriction. A progress line shows the step it is on. You can leave the page; the snapshot carries on.

The Spaces, Restricted pages, Person and Reviews tabs use the latest snapshot. The Page tab reads Confluence live.

When it is done, Latest snapshot shows the totals:

• Spaces, and spaces open to anonymous or other access
• Groups that grant access
• People who can reach a space or restricted page, and people who are admin of at least one space
• Pages and blog posts with a view restriction, and with an edit restriction
• Restricted pages only the admin sweep found (after a sweep, below)

Warnings appear under the totals, for example a space the app was not allowed to read (such as a personal space), or a site too large to check in full.

Cancel asks first. What the snapshot has read so far is deleted, and the latest saved snapshot stays as it is. If a snapshot makes no progress for 20 minutes, the page says it has stopped moving and offers Start again.

• Type a key or name in Find a space and click Search, or page through the list. Each row shows the space, its key and type.
• Show permissions lists every person and group with a permission on the space: View, Edit (the space lets them add and edit pages), Admin, and any Other permissions they hold.
• Grants that are not to a person or a group show as Anonymous (not logged in), Role: … or Other: …. The app cannot tell which people those cover.

Paste a page link or a page id in Page link or id and click Look up. The app reads the page, its parent pages and its space now, as you.

• Who can view: each view restriction on the page and on its parent pages, with the groups and people listed. Only people on all of them, who can also view the space, can see the page. The space's view permission is listed below.
• Who can edit: the page's edit restriction, if it has one, the people and groups who can add and edit pages in the space (add blog posts, for a blog post), and the space admins.
• Check one person or group: choose A person or A group, search by name, pick one, and click Check. You get Can view and Can edit from Confluence's own permission check, and under Why the app's reasons. This check only reads.
• If the two disagree, the page says Confluence gives a different answer. Something the app cannot see decides it, such as product access or a space role. Go by Confluence's answer.

Confluence may not list folders among a page's parents, so a view restriction on a folder may not show here. Confluence's own answer still takes it into account.

The Reviews tab lists the last 12 reviews: when the snapshot was taken, how many people, the status, and how many are decided. Click Open to work on one.

• The review shows who took the snapshot, the totals (keep, remove, follow up, undecided), and how many people are new since the last signed-off review.
• Each row shows the person, their groups (and whether they are also granted access directly), how many spaces they can view, edit and admin, and how many restricted pages name them. New and New space admin mark changes since the last signed-off review.
• Set Decision to Keep, Remove or Follow up. Once a person has a decision, Note adds a note of up to 500 characters.
• Filters: Decision, Group, Space admins only and New since last review.
• Mark everyone shown as Keep asks first, and only marks people with no decision. On a large review it may say some people were not reached yet; click it again to carry on.
• Sign off this review asks first. Your name and the time are saved, decisions are locked, and the review records what its restricted page list covered at that moment.
• Reopen asks first. The earlier sign-off is kept in the review's history and in the evidence file, with the name of who reopened it.
• Delete this review is offered only for a review that has never been signed off, and deletes the snapshot and its decisions. A signed-off review is kept as evidence until it is no longer one of the last 12.

Nothing changes in Confluence until you have seen the list of changes and confirmed it. Changes are made as you, so Confluence checks your own permission on each page and records you in its audit log. Only one change can be open at a time.

Copy a page's edit restriction to the pages below it. Enter the page link or id, choose Every page below it or Its direct child pages only, and click Preview the copy. Each page gets the same people and groups in its edit restriction as this page: missing ones are added, others removed. View restrictions are not changed. If this page's edit restriction leaves you out, add yourself to it first.

Add or remove a person or group on many pages. Choose Add or Remove, the View restriction or Edit restriction, and the person or group. Then choose the pages: A page and the pages below it (This page only, This page and its direct child pages or This page and every page below it), or A list of pages, one link or id per line. Click Preview the change.

• Adding to a page with no restriction of that kind creates one, so only those listed can view or edit it. You are put on a new restriction too, as Confluence does, so you can still open the page and undo the change.
• A page where the person or group is the last entry on the restriction is skipped, because removing it would open the page to everyone in the space. A page where the change would take away your own access is skipped too.
• One change covers at most 2,000 pages. Pages you cannot see are not listed and are not changed.

The preview says how many pages will change, how many already match and how many are skipped, with the reason for each. Click Apply changes and confirm, or Discard. Each page is read again just before it changes; a page that changed since the preview, so that the preview no longer holds, is left alone. Keep the page open while it runs. If you close it, open the Changes tab again to carry on. Stop stops after the page being changed.

Only the admin who planned a change can apply it. Another admin sees its progress and can stop or discard it.

• Restricted pages hidden from both the app and the admin who swept (or from the app alone, when no admin has swept). Each list says which.
• Archived pages, and pages in archived spaces. Confluence's search usually leaves them out, and the Page tab may report an archived page as not found.
• Who has viewed a page. Confluence does not give apps that.
• Product access and licences managed in Atlassian Administration. Someone may be in a group with space permissions but have no Confluence access. Confluence's answer on the Page tab does take that into account.
• Space roles by name, and anonymous access. The app shows the permissions Confluence reports. Where only such a grant would let someone in, it says Not sure or Maybe.
• Comments, attachments, whiteboards, databases and folders are not listed as restricted items. Pages and blog posts are. A view restriction on a folder also limits the pages in it; the app does not see that.
• Very large sites. The snapshot checks the first 200,000 pages and blog posts, and counts pages below for the first 3,000 view-restricted pages. A space with more than 10,000 permission entries is read in part, and a restriction with more than 2,000 people and groups is read in part and left alone by changes. The page says when any of these applies.