Skip to content

Warden

Access review evidence for Confluence, without leaving Atlassian

A periodic access review is one of the most commonly requested controls in a SOC 2 or ISO 27001 audit, and Confluence page restrictions are one of the hardest parts of it to evidence — because Confluence Cloud will not show them to you across the site. This page is about what the evidence actually needs to be, and what a tool can and cannot do for you.

A user access review is a periodic exercise in which somebody responsible looks at who currently has access to a system, decides whether each of those grants is still appropriate, removes the ones that are not, and keeps a record showing that this happened. The record is what an auditor examines — a review with no artefact is, for audit purposes, a review that did not occur.

For Confluence specifically the awkward part is page restrictions. Product and space access are visible in admin. Restrictions are set per page, can be inherited from ancestors, and have no site-wide view — so the layer that actually decides who reads a sensitive document is the layer hardest to produce evidence for.

Scope, before anything else

Warden covers page restrictions in Confluence. That is all it covers. It does not review space permissions, product access, group provisioning, Jira permission schemes, or anything outside Confluence. A complete access review is broader than this app, and any page telling you otherwise is selling you something.

What it does is close the one gap in that review that the product itself will not let you see. If your reviews already handle space permissions and product access but go quiet on “which pages are restricted, and are those restrictions still valid?”, that is the hole this fills.

What an auditor actually asks for

Auditors vary, but the requests converge on four things. It is worth knowing them before evaluating any tool, because most tools address one or two and leave the rest to you.

  • A point-in-time snapshot. Who had access to what, as of a specific date. Not a live dashboard — a dated artefact that can be filed and re-read a year later.
  • Completeness. Evidence that the snapshot covers the whole population, not a convenient sample. If part of the estate was not examined, that has to be visible rather than silently omitted.
  • What changed since the last review. The interesting content of the second and every subsequent review is the difference — new grants, removed grants, and anything that broke in between.
  • Evidence of human judgement. Someone looked, decided, and acted. No tool supplies this part, and any product claiming to is misrepresenting how audits work.

What Confluence gives you natively

Space permissions are visible per space in admin, and there is a restricted-pages view within each space. So a determined administrator can assemble a picture space by space.

What is missing is the site-wide view. There is no screen and no export that answers “which pages across this site are restricted, and to whom?”. Requests for exactly that have been open on Atlassian’s public issue tracker since 2013 — CONFCLOUD-31974 and CONFCLOUD-73066 among them — and remain in Gathering Interest. A REST API returning the list, CONFCLOUD-76815, is marked In Progress, which will help developers who can script against it.

In practice this means the restriction layer either gets excluded from the review scope, or gets sampled, or gets assembled by hand into a spreadsheet that is stale before it is signed.

What Warden produces

Warden inventories every view- or edit-restricted page across the whole site and exports it. Mapped onto the four requirements above:

  • The snapshot. Every restricted page, who can view and edit it, and whether the restriction is set directly or inherited — with the ancestor it came from. Exported as CSV, UTF-8 with a byte-order mark so it opens correctly in Excel and Google Sheets. The report carries the timestamp it was built.
  • Completeness, honestly reported. The scan walks every space. Very large sites hit a page cap, and when that happens the report is badged partial rather than presenting itself as exhaustive. An auditor would rather see a stated limit than an unstated one.
  • The difference since last time. Every scan is compared with the previous one. A banner reports how many red flags are new and how many were resolved, each new finding is marked, and the red-flags CSV carries a New since last scan column — so a quarterly review can begin from what changed.
  • The findings worth acting on. Restrictions naming a deactivated user, an empty group, or a principal that no longer exists — plus pages where every grantee is dead, so the intended audience is locked out entirely. These are the items a reviewer should be spending their judgement on.

A daily automatic re-scan keeps the snapshot current between reviews, and you can run one on demand at any time.

What it does not do — read this part

  • It does not make you compliant, and it does not claim to. It produces evidence. A human still reviews it, decides, acts, and signs. There is no product that can do that part, and treating a report as a control is how audits fail.
  • It is not a historical change log. A Forge app cannot reconstruct who changed a restriction and when, before it was installed. The “since last scan” comparison starts at your second scan. If your auditor specifically wants a change history rather than periodic snapshots, this is not that, and no amount of configuration will make it that.
  • It does not remediate. Warden’s manifest declares no write scope for Confluence content, so it cannot alter a restriction. That is a deliberate design decision — a read-only tool has a much smaller blast radius in an access-control context — but it does mean the fixing is your job.
  • Deactivated-user detection is best-effort under the Runs on Atlassian constraints, while the empty-group and orphaned-principal flags are exact. Worth knowing before you present the output as definitive.

Where it runs, and what that is worth

Warden carries Atlassian’s Runs on Atlassian badge. It runs entirely inside your own Atlassian cloud with no external servers, so the inventory of who can see what is never transmitted to a vendor. Its scopes are read-only and in-tenant: read:page, read:space, read:content-details, read:group and read:user — all Confluence-scoped — plus storage:app for the snapshot. There is no write scope in the manifest.

For a tool whose entire subject matter is access control, that is a meaningful property: adding it does not add a data processor, and it does not add a system that could change your restrictions.

Two honest qualifications. First, running on Atlassian means the app inherits Atlassian’s SOC 2 and ISO 27001 posture for where it runs — it is not a certification held by Hullara, and it does not substitute for your own controls. Second, roughly a third of the Marketplace carries this badge, so it helps an app pass an enterprise filter rather than distinguishing it. Hullara is not Cloud Fortified, which several larger vendors are; if your procurement process requires that, Warden does not qualify today.

The full report — inventory, red flags and the daily re-scan — is free at any team size. CSV export, which is the artefact you actually file, is the paid part: free for sites of 10 users or fewer, and from $1.10 per user per month above that.

Questions

Also worth reading: finding every restricted page in Confluence · who can actually see this page · Warden’s privacy policy.

Questions

Does Warden make my Confluence SOC 2 compliant?
No. No app can. It produces point-in-time evidence about page restrictions that a human reviews, acts on and signs off. Compliance is the outcome of your controls and your auditor’s opinion of them.
What part of an access review does it cover?
Page restrictions in Confluence, and only those. It does not cover space permissions, product access, group provisioning or anything in Jira. It exists to close the one part of the review Confluence Cloud will not show you across the site.
Can it show what changed since our last review?
Yes, from the second scan onwards. Each scan is compared with the previous one, new and resolved red flags are counted, and the red-flags CSV carries a New since last scan column. It cannot show changes made before the app was installed.
Is the export usable as audit evidence?
It is a dated, complete CSV of the restricted pages and the flagged findings, with partial scans marked as partial. Whether that satisfies a particular auditor is between you and them, and it is only evidence of the state — evidence of review is your record of what you decided.
Does our page content leave Atlassian?
No. Warden runs inside your own Atlassian cloud under the Runs on Atlassian badge, with read-only Confluence scopes and no external servers. The snapshot is stored in Atlassian-hosted storage in your tenant.
Can it fix the problems it finds?
No, deliberately. Its manifest carries no write scope for Confluence content, so it is incapable of modifying a restriction. It reports; you remediate.
Is Hullara Cloud Fortified?
No. Cloud Fortified covers vendor operational maturity — reliability commitments, incident management, a bug bounty — and is earned over operating history. If your procurement requires it, Warden does not currently qualify.
Get Warden on the Atlassian Marketplace