aigroup-workflow 1.0.1 → 1.1.1

package/skills/jarvis/engineering-team/project-management/atlassian-admin/SKILL.md

@@ -1,234 +0,0 @@
----
-name: "atlassian-admin"
-description: Atlassian Administrator for managing and organizing Atlassian products (Jira, Confluence, Bitbucket, Trello), users, permissions, security, integrations, system configuration, and org-wide governance. Use when asked to add users to Jira, change Confluence permissions, configure access control, update admin settings, manage Atlassian groups, set up SSO, install marketplace apps, review security policies, or handle any org-wide Atlassian administration task.
----
-
-# Atlassian Administrator Expert
-
-## Workflows
-
-### User Provisioning
-1. Create user account: `admin.atlassian.com > User management > Invite users`
-   - REST API: `POST /rest/api/3/user` with `{"emailAddress": "...", "displayName": "...","products": [...]}`
-2. Add to appropriate groups: `admin.atlassian.com > User management > Groups > [group] > Add members`
-3. Assign product access (Jira, Confluence) via `admin.atlassian.com > Products > [product] > Access`
-4. Configure default permissions per group scheme
-5. Send welcome email with onboarding info
-6. **NOTIFY**: Relevant team leads of new member
-7. **VERIFY**: Confirm user appears active at `admin.atlassian.com/o/{orgId}/users` and can log in
-
-### User Deprovisioning
-1. **CRITICAL**: Audit user's owned content and tickets
-   - Jira: `GET /rest/api/3/search?jql=assignee={accountId}` to find open issues
-   - Confluence: `GET /wiki/rest/api/user/{accountId}/property` to find owned spaces/pages
-2. Reassign ownership of:
-   - Jira projects: `Project settings > People > Change lead`
-   - Confluence spaces: `Space settings > Overview > Edit space details`
-   - Open issues: bulk reassign via `Jira > Issues > Bulk change`
-   - Filters and dashboards: transfer via `User management > [user] > Managed content`
-3. Remove from all groups: `admin.atlassian.com > User management > [user] > Groups`
-4. Revoke product access
-5. Deactivate account: `admin.atlassian.com > User management > [user] > Deactivate`
-   - REST API: `DELETE /rest/api/3/user?accountId={accountId}`
-6. **VERIFY**: Confirm `GET /rest/api/3/user?accountId={accountId}` returns `"active": false`
-7. Document deprovisioning in audit log
-8. **USE**: Jira Expert to reassign any remaining issues
-
-### Group Management
-1. Create groups: `admin.atlassian.com > User management > Groups > Create group`
-   - REST API: `POST /rest/api/3/group` with `{"name": "..."}`
-   - Structure by: Teams (engineering, product, sales), Roles (admins, users, viewers), Projects (project-alpha-team)
-2. Define group purpose and membership criteria (document in Confluence)
-3. Assign default permissions per group
-4. Add users to appropriate groups
-5. **VERIFY**: Confirm group members via `GET /rest/api/3/group/member?groupName={name}`
-6. Regular review and cleanup (quarterly)
-7. **USE**: Confluence Expert to document group structure
-
-### Permission Scheme Design
-**Jira Permission Schemes** (`Jira Settings > Issues > Permission Schemes`):
-- **Public Project**: All users can view, members can edit
-- **Team Project**: Team members full access, stakeholders view
-- **Restricted Project**: Named individuals only
-- **Admin Project**: Admins only
-
-**Confluence Permission Schemes** (`Confluence Admin > Space permissions`):
-- **Public Space**: All users view, space members edit
-- **Team Space**: Team-specific access
-- **Personal Space**: Individual user only
-- **Restricted Space**: Named individuals and groups
-
-**Best Practices**:
-- Use groups, not individual permissions
-- Principle of least privilege
-- Regular permission audits
-- Document permission rationale
-
-### SSO Configuration
-1. Choose identity provider (Okta, Azure AD, Google)
-2. Configure SAML settings: `admin.atlassian.com > Security > SAML single sign-on > Add SAML configuration`
-   - Set Entity ID, ACS URL, and X.509 certificate from IdP
-3. Test SSO with admin account (keep password login active during test)
-4. Test with regular user account
-5. Enable SSO for organization
-6. Enforce SSO: `admin.atlassian.com > Security > Authentication policies > Enforce SSO`
-7. Configure SCIM for auto-provisioning: `admin.atlassian.com > User provisioning > [IdP] > Enable SCIM`
-8. **VERIFY**: Confirm SSO flow succeeds and audit logs show `saml.login.success` events
-9. Monitor SSO logs: `admin.atlassian.com > Security > Audit log > filter: SSO`
-
-### Marketplace App Management
-1. Evaluate app need and security: check vendor's security self-assessment at `marketplace.atlassian.com`
-2. Review vendor security documentation (penetration test reports, SOC 2)
-3. Test app in sandbox environment
-4. Purchase or request trial: `admin.atlassian.com > Billing > Manage subscriptions`
-5. Install app: `admin.atlassian.com > Products > [product] > Apps > Find new apps`
-6. Configure app settings per vendor documentation
-7. Train users on app usage
-8. **VERIFY**: Confirm app appears in `GET /rest/plugins/1.0/` and health check passes
-9. Monitor app performance and usage; review annually for continued need
-
-### System Performance Optimization
-**Jira** (`Jira Settings > System`):
-- Archive old projects: `Project settings > Archive project`
-- Reindex: `Jira Settings > System > Indexing > Full re-index`
-- Clean up unused workflows and schemes: `Jira Settings > Issues > Workflows`
-- Monitor queue/thread counts: `Jira Settings > System > System info`
-
-**Confluence** (`Confluence Admin > Configuration`):
-- Archive inactive spaces: `Space tools > Overview > Archive space`
-- Remove orphaned pages: `Confluence Admin > Orphaned pages`
-- Monitor index and cache: `Confluence Admin > Cache management`
-
-**Monitoring Cadence**:
-- Daily health checks: `admin.atlassian.com > Products > [product] > Health`
-- Weekly performance reports
-- Monthly capacity planning
-- Quarterly optimization reviews
-
-### Integration Setup
-**Common Integrations**:
-- **Slack**: `Jira Settings > Apps > Slack integration` — notifications for Jira and Confluence
-- **GitHub/Bitbucket**: `Jira Settings > Apps > DVCS accounts` — link commits to issues
-- **Microsoft Teams**: `admin.atlassian.com > Apps > Microsoft Teams`
-- **Zoom**: Available via Marketplace app `zoom-for-jira`
-- **Salesforce**: Via Marketplace app `salesforce-connector`
-
-**Configuration Steps**:
-1. Review integration requirements and OAuth scopes needed
-2. Configure OAuth or API authentication (store tokens in secure vault, not plain text)
-3. Map fields and data flows
-4. Test integration thoroughly with sample data
-5. Document configuration in Confluence runbook
-6. Train users on integration features
-7. **VERIFY**: Confirm webhook delivery via `Jira Settings > System > WebHooks > [webhook] > Test`
-8. Monitor integration health via app-specific dashboards
-
-## Global Configuration
-
-### Jira Global Settings (`Jira Settings > Issues`)
-**Issue Types**: Create and manage org-wide issue types; define issue type schemes; standardize across projects
-**Workflows**: Create global workflow templates via `Workflows > Add workflow`; manage workflow schemes
-**Custom Fields**: Create org-wide custom fields at `Custom fields > Add custom field`; manage field configurations and context
-**Notification Schemes**: Configure default notification rules; create custom notification schemes; manage email templates
-
-### Confluence Global Settings (`Confluence Admin`)
-**Blueprints & Templates**: Create org-wide templates at `Configuration > Global Templates and Blueprints`; manage blueprint availability
-**Themes & Appearance**: Configure org branding at `Configuration > Themes`; customize logos and colors
-**Macros**: Enable/disable macros at `Configuration > Macro usage`; configure macro permissions
-
-### Security Settings (`admin.atlassian.com > Security`)
-**Authentication**:
-- Password policies: `Security > Authentication policies > Edit`
-- Session timeout: `Security > Session duration`
-- API token management: `Security > API token controls`
-
-**Data Residency**: Configure data location at `admin.atlassian.com > Data residency > Pin products`
-
-**Audit Logs**: `admin.atlassian.com > Security > Audit log`
-- Enable comprehensive logging; export via `GET /admin/v1/orgs/{orgId}/audit-log`
-- Retain per policy (minimum 7 years for SOC 2/GDPR compliance)
-
-## Governance & Policies
-
-### Access Governance
-- Quarterly review of all user access: `admin.atlassian.com > User management > Export users`
-- Verify user roles and permissions; remove inactive users
-- Limit org admins to 2–3 individuals; audit admin actions monthly
-- Require MFA for all admins: `Security > Authentication policies > Require 2FA`
-
-### Naming Conventions
-**Jira**: Project keys 3–4 uppercase letters (PROJ, WEB); issue types Title Case; custom fields prefixed (CF: Story Points)
-**Confluence**: Spaces use Team/Project prefix (TEAM: Engineering); pages descriptive and consistent; labels lowercase, hyphen-separated
-
-### Change Management
-**Major Changes**: Announce 2 weeks in advance; test in sandbox; create rollback plan; execute during off-peak; post-implementation review
-**Minor Changes**: Announce 48 hours in advance; document in change log; monitor for issues
-
-## Disaster Recovery
-
-### Backup Strategy
-**Jira & Confluence**: Daily automated backups; weekly manual verification; 30-day retention; offsite storage
-- Trigger manual backup: `Jira Settings > System > Backup system` / `Confluence Admin > Backup and Restore`
-
-**Recovery Testing**: Quarterly recovery drills; document procedures; measure RTO and RPO
-
-### Incident Response
-**Severity Levels**:
-- **P1 (Critical)**: System down — respond in 15 min
-- **P2 (High)**: Major feature broken — respond in 1 hour
-- **P3 (Medium)**: Minor issue — respond in 4 hours
-- **P4 (Low)**: Enhancement — respond in 24 hours
-
-**Response Steps**:
-1. Acknowledge and log incident
-2. Assess impact and severity
-3. Communicate status to stakeholders
-4. Investigate root cause (check `admin.atlassian.com > Products > [product] > Health` and Atlassian Status Page)
-5. Implement fix
-6. **VERIFY**: Confirm resolution via affected user test and health check
-7. Post-mortem and lessons learned
-
-## Metrics & Reporting
-
-**System Health**: Active users (daily/weekly/monthly), storage utilization, API rate limits, integration health, response times
-- Export via: `GET /admin/v1/orgs/{orgId}/users` for user counts; product-specific analytics dashboards
-
-**Usage Analytics**: Most active projects/spaces, content creation trends, user engagement, search patterns
-**Compliance Metrics**: User access review completion, security audit findings, failed login attempts, API token usage
-
-## Decision Framework & Handoff Protocols
-
-**Escalate to Atlassian Support**: System outage, performance degradation org-wide, data loss/corruption, license/billing issues, complex migrations
-
-**Delegate to Product Experts**:
-- Jira Expert: Project-specific configuration
-- Confluence Expert: Space-specific settings
-- Scrum Master: Team workflow needs
-- Senior PM: Strategic planning input
-
-**Involve Security Team**: Security incidents, unusual access patterns, compliance audit preparation, new integration security review
-
-**TO Jira Expert**: New global workflows, custom fields, permission schemes, or automation capabilities available
-**TO Confluence Expert**: New global templates, space permission schemes, blueprints, or macros configured
-**TO Senior PM**: Usage analytics, capacity planning insights, cost optimization, security compliance status
-**TO Scrum Master**: Team access provisioned, board configuration options, automation rules, integrations enabled
-**FROM All Roles**: User access requests, permission changes, app installation requests, configuration support, incident reports
-
-## Atlassian MCP Integration
-
-**Primary Tools**: Jira MCP, Confluence MCP
-
-**Admin Operations**:
-- User and group management via API
-- Bulk permission updates
-- Configuration audits
-- Usage reporting
-- System health monitoring
-- Automated compliance checks
-
-**Integration Points**:
-- Support all roles with admin capabilities
-- Enable Jira Expert with global configurations
-- Provide Confluence Expert with template management
-- Ensure Senior PM has visibility into org health
-- Enable Scrum Master with team provisioning

package/skills/jarvis/engineering-team/project-management/atlassian-admin/assets/permission_scheme_template.json

@@ -1,173 +0,0 @@
-{
-  "permissionScheme": {
-    "name": "Standard Project Permission Scheme",
-    "description": "Default permission scheme for standard projects. Assigns permissions based on project roles.",
-    "version": "1.0",
-    "lastUpdated": "YYYY-MM-DD",
-    "owner": "IT Admin Team"
-  },
-  "roles": {
-    "projectAdmin": {
-      "description": "Full project administration including configuration and user management",
-      "typicalGroups": ["project-leads", "engineering-managers"]
-    },
-    "developer": {
-      "description": "Create and manage issues, transitions, and attachments",
-      "typicalGroups": ["dept-engineering", "dept-product"]
-    },
-    "user": {
-      "description": "View issues, add comments, and create basic issues",
-      "typicalGroups": ["org-all-employees"]
-    },
-    "viewer": {
-      "description": "Read-only access to project issues and boards",
-      "typicalGroups": ["stakeholders", "external-contractors"]
-    }
-  },
-  "permissions": {
-    "project": {
-      "ADMINISTER_PROJECTS": {
-        "description": "Manage project settings, roles, and permissions",
-        "grantedTo": ["projectAdmin"]
-      },
-      "BROWSE_PROJECTS": {
-        "description": "View the project and its issues",
-        "grantedTo": ["projectAdmin", "developer", "user", "viewer"]
-      },
-      "VIEW_DEV_TOOLS": {
-        "description": "View development panel (commits, branches, PRs)",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "VIEW_READONLY_WORKFLOW": {
-        "description": "View read-only workflow",
-        "grantedTo": ["projectAdmin", "developer", "user", "viewer"]
-      }
-    },
-    "issues": {
-      "CREATE_ISSUES": {
-        "description": "Create new issues in the project",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      },
-      "EDIT_ISSUES": {
-        "description": "Edit issue fields",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "DELETE_ISSUES": {
-        "description": "Delete issues permanently",
-        "grantedTo": ["projectAdmin"]
-      },
-      "ASSIGN_ISSUES": {
-        "description": "Assign issues to team members",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "ASSIGNABLE_USER": {
-        "description": "Be assigned to issues",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "CLOSE_ISSUES": {
-        "description": "Close/resolve issues",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "RESOLVE_ISSUES": {
-        "description": "Set issue resolution",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "TRANSITION_ISSUES": {
-        "description": "Transition issues through workflow",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      },
-      "LINK_ISSUES": {
-        "description": "Create and remove issue links",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "MOVE_ISSUES": {
-        "description": "Move issues between projects",
-        "grantedTo": ["projectAdmin"]
-      },
-      "SCHEDULE_ISSUES": {
-        "description": "Set due dates on issues",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "SET_ISSUE_SECURITY": {
-        "description": "Set security level on issues",
-        "grantedTo": ["projectAdmin"]
-      }
-    },
-    "comments": {
-      "ADD_COMMENTS": {
-        "description": "Add comments to issues",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      },
-      "EDIT_ALL_COMMENTS": {
-        "description": "Edit any comment",
-        "grantedTo": ["projectAdmin"]
-      },
-      "EDIT_OWN_COMMENTS": {
-        "description": "Edit own comments",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      },
-      "DELETE_ALL_COMMENTS": {
-        "description": "Delete any comment",
-        "grantedTo": ["projectAdmin"]
-      },
-      "DELETE_OWN_COMMENTS": {
-        "description": "Delete own comments",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      }
-    },
-    "attachments": {
-      "CREATE_ATTACHMENTS": {
-        "description": "Attach files to issues",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      },
-      "DELETE_ALL_ATTACHMENTS": {
-        "description": "Delete any attachment",
-        "grantedTo": ["projectAdmin"]
-      },
-      "DELETE_OWN_ATTACHMENTS": {
-        "description": "Delete own attachments",
-        "grantedTo": ["projectAdmin", "developer", "user"]
-      }
-    },
-    "worklogs": {
-      "WORK_ON_ISSUES": {
-        "description": "Log work on issues",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "EDIT_ALL_WORKLOGS": {
-        "description": "Edit any worklog",
-        "grantedTo": ["projectAdmin"]
-      },
-      "EDIT_OWN_WORKLOGS": {
-        "description": "Edit own worklogs",
-        "grantedTo": ["projectAdmin", "developer"]
-      },
-      "DELETE_ALL_WORKLOGS": {
-        "description": "Delete any worklog",
-        "grantedTo": ["projectAdmin"]
-      },
-      "DELETE_OWN_WORKLOGS": {
-        "description": "Delete own worklogs",
-        "grantedTo": ["projectAdmin", "developer"]
-      }
-    }
-  },
-  "projectMappings": [
-    {
-      "projectKey": "EXAMPLE",
-      "projectName": "Example Project",
-      "scheme": "Standard Project Permission Scheme",
-      "roleAssignments": {
-        "projectAdmin": ["project-leads"],
-        "developer": ["team-example-devs"],
-        "user": ["org-all-employees"],
-        "viewer": ["stakeholders-example"]
-      }
-    }
-  ],
-  "notes": {
-    "usage": "Copy this template and customize role assignments per project. Use group names that match your Atlassian groups.",
-    "review": "Review permission scheme assignments quarterly as part of access review.",
-    "changes": "Any changes to permission schemes should be documented and approved by IT Admin."
-  }
-}

package/skills/jarvis/engineering-team/project-management/atlassian-admin/references/security-hardening-guide.md

@@ -1,214 +0,0 @@
-# Atlassian Cloud Security Hardening Guide
-
-## Overview
-
-This guide provides a comprehensive security hardening checklist for Atlassian Cloud products (Jira, Confluence, Bitbucket). It covers identity management, access controls, data protection, and monitoring practices aligned with enterprise security standards.
-
-## Identity & Authentication
-
-### SSO / SAML Setup
-
-**Implementation Steps:**
-1. Verify your domain in Atlassian Admin (admin.atlassian.com)
-2. Claim all company email accounts
-3. Configure SAML SSO with your identity provider (Okta, Azure AD, Google Workspace)
-4. Set authentication policy to enforce SSO for all managed accounts
-5. Test with a pilot group before full rollout
-6. Disable password-based login for managed accounts
-
-**Configuration Checklist:**
-- [ ] Domain verified and accounts claimed
-- [ ] SAML IdP configured with correct entity ID and SSO URL
-- [ ] Attribute mapping: email, displayName, groups
-- [ ] Single Logout (SLO) configured
-- [ ] Authentication policy enforcing SSO
-- [ ] Fallback access configured for emergency admin accounts
-- [ ] SCIM provisioning enabled for automatic user sync
-
-### Two-Factor Authentication (2FA)
-
-**Enforcement Policy:**
-- [ ] 2FA required for all managed accounts
-- [ ] Enforce via authentication policy (not just recommended)
-- [ ] Hardware security keys (FIDO2/WebAuthn) preferred for admin accounts
-- [ ] TOTP (authenticator app) as minimum for all users
-- [ ] SMS-based 2FA disabled (SIM swap vulnerability)
-- [ ] Recovery codes generated and stored securely
-
-### Session Management
-- [ ] Session timeout set to 8 hours of inactivity (maximum)
-- [ ] Absolute session timeout: 24 hours
-- [ ] Require re-authentication for sensitive operations
-- [ ] Monitor concurrent sessions per user
-- [ ] Enforce session termination on password change
-
-## Access Controls
-
-### IP Allowlisting
-
-**Configuration:**
-- [ ] Enable IP allowlisting for organization
-- [ ] Add corporate office IP ranges
-- [ ] Add VPN exit node IP addresses
-- [ ] Add CI/CD server IPs for API access
-- [ ] Test access from all approved locations
-- [ ] Document approved IP ranges with justification
-- [ ] Review IP allowlist quarterly
-
-**Exceptions:**
-- Mobile access may require VPN or MDM solution
-- Remote workers need VPN or conditional access policies
-- API integrations need stable IP ranges
-
-### API Token Management
-
-**Policies:**
-- [ ] Inventory all API tokens in use
-- [ ] Set maximum token lifetime (90 days recommended)
-- [ ] Require token rotation on schedule
-- [ ] Use service accounts for integrations (not personal tokens)
-- [ ] Monitor API token usage patterns
-- [ ] Revoke tokens immediately on employee departure
-- [ ] Document purpose and owner for each token
-
-**Best Practices:**
-- Use OAuth 2.0 (3LO) for user-context integrations
-- Use API tokens only for service-to-service
-- Store tokens in secrets management (never in code)
-- Implement least-privilege scopes for OAuth apps
-
-### Permission Model
-- [ ] Review global permissions quarterly
-- [ ] Use groups for permission assignment (not individual users)
-- [ ] Implement role-based access for Jira projects
-- [ ] Restrict Confluence space admin to designated owners
-- [ ] Limit Jira system admin to 2-3 people
-- [ ] Audit "anyone" or "logged in users" permissions
-- [ ] Remove direct user permissions where groups exist
-
-## Audit & Monitoring
-
-### Audit Log Configuration
-
-**What to Monitor:**
-- User authentication events (login, logout, failed attempts)
-- Permission changes (project, space, global)
-- User account changes (creation, deactivation, group changes)
-- API token creation and revocation
-- App installations and updates
-- Data export operations
-- Admin configuration changes
-
-**Setup Steps:**
-- [ ] Enable organization audit log
-- [ ] Configure audit log retention (minimum 1 year)
-- [ ] Set up automated export to SIEM (Splunk, Datadog, etc.)
-- [ ] Create alerts for suspicious patterns
-- [ ] Schedule monthly audit log review
-- [ ] Document incident response procedures for alerts
-
-### Alerting Rules
-
-**Critical Alerts (Immediate Response):**
-- Multiple failed login attempts (>5 in 10 minutes)
-- Admin permission grants to unexpected users
-- API token created by non-service accounts
-- Bulk data export or deletion
-- New third-party app installed with broad permissions
-
-**Warning Alerts (Same-Day Review):**
-- New admin users added
-- Permission scheme changes
-- Authentication policy modifications
-- IP allowlist changes
-- User deactivation (verify it is expected)
-
-## Data Protection
-
-### Data Residency
-- [ ] Configure data residency realm (US, EU, AU, etc.)
-- [ ] Verify product data pinned to selected region
-- [ ] Document data residency for compliance audits
-- [ ] Review data residency coverage (some metadata may be global)
-- [ ] Monitor for new residency options from Atlassian
-
-### Encryption
-- [ ] Verify encryption at rest (AES-256, managed by Atlassian)
-- [ ] Verify encryption in transit (TLS 1.2+)
-- [ ] Review Atlassian's encryption key management practices
-- [ ] Consider BYOK (Bring Your Own Key) for Atlassian Guard Premium
-
-### Data Loss Prevention
-- [ ] Configure content restrictions for sensitive pages/issues
-- [ ] Implement classification labels (public, internal, confidential)
-- [ ] Restrict file attachment types if needed
-- [ ] Monitor bulk exports and downloads
-- [ ] Set up DLP rules for sensitive data patterns (PII, credentials)
-
-## Mobile Device Management
-
-### Mobile Access Controls
-- [ ] Require MDM enrollment for mobile Atlassian apps
-- [ ] Enforce device encryption
-- [ ] Require screen lock with biometrics or PIN
-- [ ] Enable remote wipe capability
-- [ ] Block rooted/jailbroken devices
-- [ ] Restrict copy/paste to managed apps
-- [ ] Set app-level PIN for Atlassian apps
-
-### Mobile Policies
-- [ ] Define approved mobile devices/OS versions
-- [ ] Enforce automatic app updates
-- [ ] Configure offline data access limits
-- [ ] Set maximum offline cache duration
-- [ ] Review mobile access logs monthly
-
-## Third-Party App Security
-
-### App Review Process
-- [ ] Maintain approved app list (whitelist)
-- [ ] Review app permissions before installation
-- [ ] Verify app is Atlassian Marketplace certified
-- [ ] Check app vendor security certifications
-- [ ] Assess data access scope (read-only vs read-write)
-- [ ] Review app privacy policy
-- [ ] Document app owner and business justification
-
-### App Governance
-- [ ] Audit installed apps quarterly
-- [ ] Remove unused apps (no usage in 90 days)
-- [ ] Monitor app permission changes
-- [ ] Restrict app installation to admins only
-- [ ] Review Atlassian Guard app access policies
-- [ ] Set up alerts for new app installations
-
-## Compliance Documentation
-
-### Required Documentation
-- [ ] Security policy for Atlassian Cloud usage
-- [ ] Access control matrix (roles, permissions, justification)
-- [ ] Incident response plan for Atlassian security events
-- [ ] Data classification policy applied to Atlassian content
-- [ ] Third-party app risk assessments
-- [ ] Annual security review report
-
-### Compliance Frameworks
-- **SOC 2:** Map Atlassian controls to Trust Service Criteria
-- **ISO 27001:** Align with Annex A controls for cloud services
-- **GDPR:** Configure data residency, right to deletion, DPAs
-- **HIPAA:** Review BAA availability, encryption, access controls
-
-## Hardening Schedule
-
-| Task | Frequency | Owner |
-|------|-----------|-------|
-| Permission audit | Quarterly | IT Admin |
-| API token rotation | Every 90 days | Integration owners |
-| App review | Quarterly | IT Admin |
-| Audit log review | Monthly | Security team |
-| IP allowlist review | Quarterly | IT Admin |
-| Authentication policy review | Semi-annually | Security team |
-| Full security assessment | Annually | Security team |
-| User access review | Quarterly | Managers + IT Admin |
-| Data residency verification | Annually | Compliance |
-| Mobile device audit | Quarterly | IT Admin |