Change Evidence Guardian

Inspiration

Before a SOC 2 or ISO 27001 audit, someone on the team spends days collecting screenshots to prove that each change was approved by someone other than its author, that the right tests ran and that security findings were handled. The facts already sit in Jira, the CI system and the release record. Nobody has assembled them per change.

What it does

• Issue panel "Change evidence" on every Jira issue: one click runs nine policy checks (linked requirement, no self-approval, at least one approval, independent reviewer for payment, auth and security changes, integration tests for sensitive changes, no open critical or high findings, risk acceptance for medium findings, staging deployment, evidence summary). It shows Pass, Conditional Pass, Needs Review or Fail with a 0-100 risk score, the evidence behind each result, and the frameworks each failure touches.
• Automatic re-check when an issue changes status, so the stored result is current when the change reaches release.
• Rovo agent "Change Evidence Guardian" with four actions: check a change, build the evidence pack for a fix version, explain a finding, publish the pack to Confluence. The prompt forbids inventing results: the agent reports only what the actions return and says plainly when evidence is missing.
• Confluence evidence pack: one page per fix version, created or updated in place, with per-change results, the framework map and an evidence graph, ready to hand to an auditor.
• MCP server (rovo:mcp) exposing the three read-only tools to external agents, with an open skill.md that tells an agent how to use them.

How we built it

• Forge app in TypeScript on the nodejs22.x runtime. UI Kit panel, Forge resolver, Rovo rovo:agent and action modules, rovo:mcp, an avi:jira:updated:issue trigger, Forge KVS for stored results.
• Jira REST v3 through requestJira (issue fields, changelog transitions as approvals, issue links, user groups as teams, an issue property written by CI for build and scan evidence) and Confluence REST v2 through requestConfluence.
• The policy engine, risk scoring and report generator are pure TypeScript with no Forge imports, covered by 76 unit tests that never touch the network.
• All logic is deterministic and stays inside Atlassian. The Forge CLI marks the app eligible for the Runs on Atlassian program.

Challenges

• Jira has no app-readable build or security-scan API, so CI writes a small ceg.evidence issue property. Without it the app says the evidence is missing instead of scoring a pass.
• Approvals in Jira are workflow transitions, so the engine treats a transition into "Approved" as an approval and compares the approver with the author and their team.

What we learned

Rovo agents become trustworthy for compliance work when every number comes from an action and the prompt only explains it.

What's next

Bitbucket pull-request evidence (reviewers, pipelines, changed files), an admin settings page for status names and team groups, a release dashboard with score history, and a Marketplace listing.

Technology

Built on Forge after the start of the submission period (git history from 2026-11-04), with manifest.yml declaring jira:issuePanel, rovo:agent, four action modules, rovo:mcp, trigger and function modules. It integrates Jira, Confluence and Rovo.

Built With

• confluence
• forge
• jira
• mcp
• node.js
• rovo
• typescript