Confluence · Page-Restriction Governance

See every restricted page in Confluence Cloud and who can reach it

Every restricted page, who holds read and update on it, orphaned restrictions, and what changed.

Try it free on the Atlassian Marketplace Documentation

Runs entirely on Atlassian Forge inside your own tenant. No external servers, no data egress.

Why it exists

This app answers a request that has been open on Atlassian's public tracker for years: CONFCLOUD-74405, "List which spaces and restricted pages a group can access", with 122 votes. We wrote up the problem and the native workarounds on Atlassian Community.

The gap

Restrictions are set page by page, by anyone, with no site-wide view of who can see what. Restrictions keep naming accounts deactivated a year ago, and nobody can list which pages are locked down or why.

What it does

Inventories every restricted page site-wide, daily and on demand.
Lists the exact users and groups holding read and update on each page.
Flags orphan restrictions naming deactivated accounts.
Notes restricted pages inheriting from a read-restricted ancestor.
Tracks drift vs the previous run: pages and subjects added or removed.
One-click, audit-ready CSV export of the full inventory.

The inventory: every restricted page with its holders.

Orphan flags: restrictions still naming deactivated accounts.

The daily sweep tracks what changed since the previous run.

60-second walkthrough

Honest about its limits

The inventory covers explicit page restrictions and notes ancestor inheritance. Space-level permissions are a different surface and are not re-derived per page.
Drift history starts at install.
The one write path, honestly scoped: An optional, previewed removal can strip orphaned restrictions that name deactivated accounts, after explicit confirmation.

Security & permissions

Built on Atlassian Forge: the app runs on Atlassian's own serverless platform inside your tenant, stores its data in Forge storage, and makes no external network calls. Every scope it requests, and why:

read:space:confluence / read:page:confluence	enumerating spaces, pages, and their restrictions
storage:app	the chunked inventory and sweep state, in your tenant

The native feature it builds on

Atlassian's own documentation for what Confluence does out of the box, so you can see exactly where the gap is:

Add or remove page restrictions (support.atlassian.com)

FAQ

Does any data leave my instance?

No. The app runs on Atlassian Forge inside your own tenant with zero external egress, which makes it eligible for Atlassian's Runs on Atlassian trust marker.

How is it billed?

Through the Atlassian Marketplace, on your existing Atlassian bill, priced per user like any Cloud app. The listing has a free evaluation and the exact calculator for your tier.

Where do I get support?

Email support@llmgraph.ai or open an issue from the documentation page. You talk directly to the people who build the app.

Install Page-Restriction Governance in about a minute.

Free evaluation from the Marketplace listing. If it does not fit your workflow, tell us what would and we will build it.

Try it free Read the deep-dive