Access Issue Resolver - ROVO AI Agent built with Atlassian Forge

[#1]

Overview

Access management in Jira is often one of the most time-consuming and confusing areas for administrators.
Project roles, global permissions, and group memberships frequently overlap - making it difficult to quickly answer questions like:

• “Why can’t I access this project?”
• “Do I have the right role to edit issues?”
• “Is my group even linked to this project?”

The Access Issue Resolver ROVO AI Agent is designed to tackle exactly that problem.

It acts as a smart assistant for Jira Admins, instantly diagnosing why a user cannot access a project or an issue - and guiding both admins and users toward the fastest resolution.

What It Does

The Access Issue Resolver is an AI-powered ROVO agent built on the Atlassian Forge platform.
It integrates directly within the Jira global ROVO chat and the Jira Admin context, supporting natural-language queries such as:

“Why can’t Akhand access the TEST project?”
“Do I have any roles in HR Portal?”
“Which groups give me access to Service Desk Pro?”
“Who has Browse permission in Engineering Hub?”

Behind the scenes, the agent performs an intelligent multi-layer analysis:

1. User Identification: Finds the user by display name or email with fuzzy matching.
2. Group Traversal: Retrieves all Jira groups the user belongs to (with pagination for large groups).
3. Role Mapping: Cross-checks which of those groups (or the user directly) are assigned project roles.
4. Access Evaluation: Determines whether the user can browse, comment, or administer a project.
5. Resolution Suggestion: Provides human-readable explanations - e.g.

“You can browse issues because your group service-agents is assigned to Service Desk Team role in project HR Portal.”
or
“You don’t currently have access. To request it, a JSM ticket can be created automatically.”

Core Capabilities

Capability	Description
User Group Lookup	Lists all groups a user is part of, even when there are multiple accounts with similar names.
Group Members Retrieval	Displays all members of a specific group (handles pagination for > 50 members).
Membership Verification	Checks whether a particular user belongs to a group.
Project Access Analyzer	Lists all projects a group has access to and shows their roles.
License Utilization Insights	Optionally estimates license usage based on group activity trends.
Natural-Language ROVO Interface	Interact conversationally from the Jira homepage or ROVO chat - no commands needed.

How It Works (Under the Hood)

The agent is built using:

• Forge Runtime: nodejs22.x
• Modules: rovo:agent with multi-action support
• Scopes: manage:jira-configuration, read:jira-user, read:jira-work
• Pagination Handling: Efficient looping with startAt and maxResults for large datasets
• Fuzzy Matching: Graceful handling of names and group strings with spaces/special characters
• Context Awareness: Understands Jira project roles, permission schemes, and direct vs group-based access

The result is a lightweight yet powerful ROVO agent that feels like a built-in Jira admin co-pilot.

Example Interaction

User: “Why can’t I see the TEST project?”
ROVO Agent:

You currently do not have any direct or group-based roles assigned in the TEST project.

Direct roles: none
Via groups: none

You do have browse permission via global access, but no project-specific role.

Would you like me to create a JSM ticket to request Developer access?

Use Cases

• For Admins: Instant visibility into user/project access without opening multiple screens.
• For Service Desks: Auto-resolve “access denied” requests directly through chat.
• For Auditors: Generate access summary reports on demand.
• For Project Leads: Validate who truly has role-based access to their projects.

Developer Highlights

• Single function (index.js) handles all logic - user lookup, group analysis, role mapping.
• No hardcoded values: Works dynamically across any Jira Cloud instance.
• Real-time logging: Each step traced in forge logs for debugging and monitoring.
• Seamless ROVO integration: The agent can be invoked globally or within a specific context.

Future Enhancements

• Predictive license exhaustion forecasting
• Advanced permission-scheme breakdown
• Role-based recommendations (“minimal access required for X action”)
• Confluence integration for unified user access intelligence

Conclusion

The Access Issue Resolver ROVO AI Agent reimagines how Jira Admins handle access-related queries.
It saves time, reduces manual checks, and empowers users to self-diagnose access problems - all within a natural-language experience powered by ROVO and Forge.

If you’re an admin striving for faster access troubleshooting and better visibility, this ROVO agent is a must-try (will shortly share my GitHub Repo for this).

SHORT DEMO

[Rick Westbrock]

I don't see it in my tenant yet so what is the rollout timeline for this new agent?

[Akhand Pratap Singh]

Hello @Rick Westbrock , 

This is a custom ROVO AI Agent that I created using forge and is not generally available. 

I will shortly share GitHub repo for this AI agent, which you can use to create your own. 

[Jean Gordon]

Not for us as we have users who are proactive and dont need to have someone tell them what to do.

I am not sure why so many changes that break our security are introduced.

Good luck to those who need this to understand anything.

[Akhand Pratap Singh]

Hi @Jean Gordon ,

Appreciate your perspective, and that’s actually a great point. The Access Issue Resolver isn’t meant to replace proactive users or experienced admins; it’s designed to support teams at scale where not everyone has admin visibility or deep Jira knowledge.

Many organizations I’ve worked with have thousands of users, distributed access patterns, and complex group-role hierarchies. For those environments, even proactive users often struggle to understand why access is missing or which group gives them the right role. That’s exactly where this AI agent saves time and prevents unnecessary admin escalations without compromising security.

Also it is Just a Custom ROVO AI agent I created, nothing that Atlassian has enforced.

Thanks again for sharing your thoughts :)

[Angie Affolter]

I think much of this functionality would be useful, but it looks like it's primarily based on groups and what we can't pull from Jira right now is reporting of roles.  

I want to know what users are assigned to each project, what role they have, as we audit regularly for users who haven't accessed for at least 60 days. I'd also want to know if someone has an account but is not on a project.

It looks like you're sharing the code if folks want it to use or adapt?  Am I understanding that correctly?

[Akhand Pratap Singh]

Hi @Angie Affolter ,

Currently, my ROVO AI Agents analyze the username mentioned in a prompt to verify whether that user has the required project roles and valid licenses. The license verification is based on group membership that grants product access, while project role validation is performed through the Jira REST API.

Your requirement is absolutely achievable; either by combining ROVO and Forge or by using Forge alone.

For example, if you’re building a Custom UI Forge app for reporting, you could:

1. Use one API to fetch users from a specific group.

2. Then, use project role APIs to check those users’ roles within the desired projects.

It’s a bit complex, but completely doable.

I’ll share sample code that you can use to build your own AI agent. It’s a basic version, so be sure to meet all your organization’s security and compliance requirements before using it. :)

If you’re on Premium or Enterprise, under Settings --> Site Optimizer, you’ll find the Project Role Permissions section. However, note that it only applies to inactive users (likely deactivated or suspended), so it may not fully cover your use case.

Best Regards,
Akhand Pratap Singh