Block Secrets in Confluence Pages and Comments
Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
Stops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.
confluenceatlassiandeny-public-exposurepublicationgovernanceingressfinserv-commseu-ai-actsoc2gdpr-ccpa
Freezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.
confluenceatlassianfreeze-destructive-opsdata-protectioningresssoc2
Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…
confluenceatlassianredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
Fences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…
confluenceatlassianfence-sensitive-scopesaccess-controlingresssoc2hipaagdpr-ccpa
Reusable DTwo policies for Confluence MCP servers — the official Atlassian Rovo MCP server that the Claude "Atlassian" connector is built on (camelCase tool names surfaced lowercased with an atlassian- prefix, e.g. atlassian-getconfluencepage), plus the mature community sooperset/mcp-atlassian server (snake_case, confluence_-prefixed). The MCP surface is read tools (page fetch, descendants, footer/inline comments, space and page listing), CQL search, and externally visible write tools (create/update page and blog, footer/inline comments, labels, attachments) — plus, on the community server only, two irreversible destructive tools (confluence_delete_page, confluence_delete_attachment). Its risk profile is dominated by publication and visibility, not deletion: the official server has no delete tools at all, but a page or blog set status:"current" in a public or anonymous-access space publishes instantly and org-wide, one searchConfluenceUsingCql call can trawl HR, legal, and security-incident spaces the user technically has access to (carrying PII and whatever secrets were pasted into pages), and the community server adds the only unrecoverable delete surface.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| block-secrets | ingress | Deny Confluence page- and comment-write calls whose body looks like a live credential — API key, password, token, or PEM private key. | atlassian, soc2, pci-dss, gdpr-ccpa |
| deny-public-publication | ingress | Deny Confluence page/blog create and update calls that publish org-wide or to public / anonymous-access spaces. | atlassian |
| fence-restricted-spaces | ingress | Fence agent read and search reach into restricted Confluence spaces (placeholder keys HR / LEGAL / SEC) unless the caller's IdP groups match. | atlassian, soc2, hipaa, gdpr-ccpa |
| freeze-page-deletion | ingress | Deny the two irreversible Confluence deletion tools (confluence_delete_page / confluence_delete_attachment) for all callers. |
atlassian, soc2, sox, hipaa, gdpr-ccpa |
| redact-pii-egress | egress | Redact PII (email, phone, SSN) from Confluence page, comment, and search read responses (transform-only); all other tools pass through. | soc2, hipaa, gdpr-ccpa, atlassian |
DTwo prefixes tool names with the MCP server name configured on the gateway, and the two Confluence implementations name their tools completely differently: the official server uses camelCase with the product embedded (getConfluencePage, updateConfluencePage), which the Claude connector lowercases into atlassian-getconfluencepage; the community server uses snake_case product prefixes (confluence_get_page, confluence_update_page). The policies in this directory match on the suffix case-insensitively and carry both name sets where an operation exists on both servers, so they stay portable across naming conventions — but you should always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.
Most of these policies are single-purpose and require no IdP claims. The identity-gated one (fence-restricted-spaces) reads input.subject.claims.groups with placeholder group names (e.g. hr, legal, security). Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt).
To add a Confluence policy:
apps/confluence/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["confluence"] in the policy frontmatter, plus any industry / bundle slugs that apply.bundles/atlassian), link to it from the matching landing page.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.