Your first scan. A clearer next step.

Purpose#

Guardian gives Jira Cloud administrators a read-only view of supported configuration-health risks, drift and lifecycle. It never changes Jira configuration or automatically fixes a finding.

First use#

1. Review requested read-only permissions and the Security and Data document.
2. Open Settings and confirm the daily schedule and independently configurable capabilities.
3. Run a manual scan or wait for the scheduled scan.
4. Review Coverage before interpreting Findings. A domain marked unavailable/partial is not a clean-health result.
5. Review finding evidence and guided remediation, then use normal Jira change control outside Guardian.
6. Run a later scan to confirm lifecycle/drift behavior.

Qualified rule catalog#

• Filters: FILT-001–FILT-004 — invalid JQL, inactive owner, anonymous-project exposure and broad signed-in-user sharing.
• Boards: BOARD-001–BOARD-002 — broken/inaccessible board filter and invalid quick-filter JQL.
• Permission schemes: PERM-001–PERM-004 — Anyone Browse Projects, newly added broad grant, broad configured grant and direct-user grant review.
• Workflows: WF-001–WF-002 — workflow-scheme review candidates and mapping changes.
• Fields: FIELD-001–FIELD-002 — potential duplicate custom fields and global/materially broad contexts.
• Responsibility/offboarding: OFFB-002–OFFB-004 — inactive project lead, inactive component lead and inactive direct project-role member.

An inactive account is only a Jira account-state signal, not proof of departure.

Findings and actions#

Use severity, category, rule, project, product area and lifecycle filters. Review confidence as evidence context, the evidence explanation and recommended Jira navigation. Ignore/restore changes Guardian-owned finding state only; it does not alter Jira. Re-scan after externally approved Jira changes.

Grouped review and priorities#

Overview recommends up to five review groups, labeled Act now, Review soon or Housekeeping. It ranks evidence and current Coverage, not finding volume. Partial Coverage cannot produce Act now; unavailable or failed Coverage requires verification before prioritizing. An empty queue is not site-wide health assurance.

The unfiltered actionable-open Findings page defaults to Grouped: configuration findings group by rule, responsibility findings by inactive account. Review findings opens all matching individual rows; use Load more when needed. Filters and the Individual selection remain in the detail/back route. Individual remains available, including for Ignored and Resolved. Each group shows counts and evidence context; it can contain multiple review candidates and is not one Jira problem. Unknown affected-project scope is labeled as unknown.

FIELD-002 version 3 treats global/all-issue-type contexts as LOW and otherwise ten or more explicit projects or issue types as MEDIUM. It never infers HIGH risk from breadth alone. High confidence means the breadth was observed, not that harm is proven. Older stored results change severity only on a later eligible scan. Broad-context groups are Housekeeping even while older severities remain visible.

These projections are bounded to 1,000 retained findings. If the bound or a read fails, Guardian displays an error rather than incomplete totals. No Jira changes are made by grouping or following a recommendation.

Troubleshooting#

• Scan will not start: confirm the caller is a Jira administrator, the Marketplace license is active/trial, no scan or history deletion is already running, and Atlassian Forge/Jira Cloud are operational.
• Coverage is partial/unavailable: open Coverage and read the exact domain reason. Check Jira product availability and app permissions; do not interpret the absence of findings as clean health until coverage is adequate.
• Results look stale: check the last completed scan and schedule state. A failed or partial scan never resolves existing findings.
• Deletion is still running: do not start a scan. Allow bounded background batches to finish; if the operation records a safe failure, explicitly retry it.
• Privacy maintenance is busy: reporting/erasure can temporarily block scans, export and changes even when scheduled scans are disabled. Wait for completion and contact support if it remains blocked; do not disable privacy controls. No fixed maximum duration is promised for large installations.
• JSON download fails or exceeds the limit: verify current administrator access, use the full download action again after maintenance completes, and avoid simultaneous scans or changes. A failed attempt is not a complete backup. For exports above 256 MiB, contact [email protected] for a scoped assisted-return process; do not email the full export.
• Legacy permission-data warning: some older grant records cannot be mapped safely to a person. Contact privacy support for scoped review; a broad history purge is not an automatic remedy.
• After uninstall/reinstall: Atlassian controls Forge data recovery. Do not assume prior settings/history will return; run an app-level deletion before uninstall whenever removal is required.

For ordinary help, use the support portal with a customer account, or contact [email protected]. Include app version, affected page/rule, time and time zone, expected/actual behavior, and a sanitized screenshot or correlation ID. Do not send credentials, raw payloads or full exports. Security reports go to [email protected] and privacy requests to [email protected]. See the support policy, support calendar and FAQ.