A Jira access review, signed off and ready for the auditor

SOC 2 (CC6.2 and CC6.3) and ISO 27001 (control A.5.18) both ask for regular reviews of access rights, and most frameworks expect one at least every quarter. For Jira, Atlassian gives admins the pieces: a user export with roles and last-seen dates, and group lists in Atlassian Administration. Turning those into a review an auditor will accept is manual work: join the exports in a spreadsheet, work out which groups grant which product and which are admin groups, chase a decision for each person, note who signed off, and next quarter work out what changed.

The last-seen date doesn't settle much either. It records that someone viewed a page for two seconds, not that they did any work. And an access review has to cover group membership, including people whose groups grant no product at all, not only the people holding a seat.

• Snapshots bigger than one storage record. Forge storage limits the size of each stored value. The first version kept a site's groups inside the scan record, which would pass that limit at around a thousand groups. Our code audit caught it before launch. Groups are now stored in pages of 250 and review rows in pages of 100, and users and decisions are each spread over 64 shards. Reviews saved by the earlier version still open.
• Large reviews, read in pages. The first version read a review in one call, capped at 5,000 users. Reviews are now read 1,000 rows at a time and the table fills as pages arrive. The evidence export works the same way, so there is no cap.
• Two reviewers at once. "Keep all active non-admins" used to read every decision and then rewrite them, which could lose a click another reviewer made at the same moment. Each shard is now read and written straight back. Forge storage has no compare-and-swap, so two people deciding in the same shard at the same instant can still collide. With 64 shards that is unlikely, and we document it rather than hide it.
• Who counts as an admin. Jira Cloud doesn't tell apps which groups are admin groups, so the app recognises them by name. The page, the filters and the evidence file all say "by name", so nobody mistakes it for a verified permission.
• Evidence built in the browser. UI Kit can't start a file download, and a page can hold only one Custom UI frame. One small frame builds the multi-sheet Excel workbook and the CSV in the admin's browser and saves the file to their device. No server of ours ever sees a review.
• Licence rules that respect the customer's data. Setting decisions and reopening a review need an active subscription. Opening, downloading and deleting past reviews do not, so a customer whose subscription has ended can still give evidence to an auditor or remove their data.
• Only admins, checked every time. Before it serves any request, the app asks Jira, as the signed-in user, whether they are a Jira administrator. If that check fails for any reason, the request is refused. Names and emails are never stored. They are read from Jira when the page or the evidence file needs them.