confluence · ingress
Block Secrets in Confluence Pages and Comments
Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
Atlassian bundle
Included policies (13)
confluence · ingress
Confluence: Deny Org-Wide & Public Publication
Stops a prompt-injected or erring agent from broadcasting Confluence content org-wide or to anonymous external readers.
confluenceatlassiandeny-public-exposurepublicationgovernanceingressfinserv-commseu-ai-actsoc2gdpr-ccpa
confluence · ingress
Confluence: Freeze Page & Attachment Deletion
Freezes the two irreversible Confluence deletion tools on the agent channel: confluence delete page and confluence delete attachment.
confluenceatlassianfreeze-destructive-opsdata-protectioningresssoc2
confluence · egress
Confluence: Redact PII from Page & Comment Responses
Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…
confluenceatlassianredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
confluence · ingress
Fence Confluence Reads & Search to Non-Restricted Spaces
Fences a configurable set of restricted Confluence spaces (placeholder keys: HR, LEGAL, SEC) out of the agent's read and search paths unless the caller's IdP…
confluenceatlassianfence-sensitive-scopesaccess-controlingresssoc2hipaagdpr-ccpa
jira · ingress
Force Internal Visibility on JSM Comments
Keeps agent-drafted Jira Service Management (JSM) comments off the customer-facing portal by rewriting addCommentToJiraIssue calls to carry a restrictive…
jiraforce-internal-commentscommentsjsmservice-managementingresssoc2atlassian
jira · ingress
JIRA: Block Change-History Actor Spoofing
Blocks any official Jira write call — transitionJiraIssue, editJiraIssue, or createJiraIssue — that carries a historyMetadata block, before it reaches the…
jiraatlassianfreeze-destructive-opsaudit-integrityingresssoc2
jira · ingress
JIRA: Cap Field and Result Exposure on Reads
Narrows the breadth of JIRA read requests before they run, on the two read surfaces that can pull large amounts of issue data into model context:
jiraatlassiancap-bulk-exportdata-minimisationingresssoc2gdpr-ccpa
jira · ingress
JIRA: Deny Sensitive Project Search and View
Keeps issues that belong to a configurable set of "sensitive" JIRA projects out of read access through the JIRA MCP server.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
jira · ingress
JIRA: Freeze Destructive Issue Operations
Freezes the three irreversible Jira operations on the agent channel: jira delete issue, jira remove issue link, and jira remove watcher.
jiraatlassianfreeze-destructive-opsrecord-integritydata-protectioningresssoc2
jira · ingress
JIRA: Protect Sensitive Projects from Writes
Blocks write operations against issues that belong to a configurable set of "sensitive" JIRA projects.
jiraatlassianaccess-controldata-protectioningresssoc2gdpr-ccpaiso27001-nistfinserv-comms
jira · ingress
JIRA: Role-Gated Writes (Read-Only Default)
Makes Jira read-only by default on the MCP path.
jiraatlassianrole-gate-writesaccess-controlleast-privilegeingresssoc2gdpr-ccpa
About this bundle
A curated bundle of policies for Atlassian MCP servers (JIRA today; Confluence and Bitbucket planned). The goal is a sensible default posture for any organization fronting an Atlassian tool through the DTwo gateway: keep PII, credentials, and secrets from leaking out of issue and page content, and keep writes clean.
Included policies
| Policy | App | Direction | Purpose |
|---|---|---|---|
| redact-sensitive-info | jira | egress | Redact PII, credentials, and secrets from JIRA issue-view responses (issues, JQL search, comments, worklogs, remote links). Transform-only — never denies. |
| deny-view-search-sensitive-projects | jira | ingress | Deny direct views and explicit JQL searches of sensitive projects; silently filter generic searches to exclude them. |
| deny-write-sensitive-projects | jira | ingress | Deny write operations (edit/transition/comment/create/move/link, etc.) on issues in sensitive projects. |
Policy bodies live under
apps/. This page only links to them — see the top-level README for the rationale.
How bundle membership works
Bundle membership is declared in each policy's policy.md frontmatter (the policy lists bundles: ["atlassian"]). This page is a human-readable landing page; the generated manifest.json is the machine-readable source of truth. There is intentionally no separate bundle.json artifact — one source of metadata avoids drift.
The bundle's policies are designed to compose cleanly. The redaction policy is transform-only (default allow := true) and scoped narrowly to JIRA issue-view tools, so it never denies a call and never interferes with other policies on the same egress pipeline. The deny-view-search-sensitive-projects and deny-write-sensitive-projects policies run on the ingress pipeline (a separate direction) and only act on JIRA tools — the former on read tools, the latter on write tools — so none of the three collide. Together they give read-path access control, write-path protection for the same project set, and an egress redaction backstop. The two project-restriction policies each carry their own sensitive_projects set; keep them in sync.
What's intentionally not in the bundle
- Project / board allow-deny lists. These are tenant-specific (your project keys aren't ours) and belong in your private policy repo.
- Identity-scoped gates. IdP claims (
org_id,groups, etc.) vary by deployment. Add these as separate policies in your gateway. - Ingress write controls. Blocking secrets from being written into issues is a complementary concern; an ingress companion policy is planned.
Roadmap
- Confluence equivalents (
apps/confluence/redact-sensitive-info, …) once a stable Confluence MCP server lands in the catalog. - Bitbucket equivalents.
- An ingress policy that blocks credentials from being pasted into new JIRA issues and comments.