Attestly

Jira shows who has access today. An auditor asks who had access on 31 March, who confirmed it, and what changed since the last review. The organisation audit log keeps 180 days, so last quarter's evidence is already gone.

Attestly snapshots who can reach each Jira project and by which path: directly, through a group, a project role, or a group inside a role. A named reviewer decides RETAIN, REVOKE or ESCALATE on every line, with a written reason for elevated access. Each review is compared with the previous one, and the evidence pack carries a hash-chained log your auditor verifies offline, without trusting us.

Grants that are not a list of people, such as Assignee or Anyone, are attested as rules. App accounts get their own table and can be decided together.

Attestly never changes permissions and requests read-only scopes. It runs on Atlassian: no data leaves Atlassian, and no AI is involved. Company-managed and team-managed projects; Confluence is next.