Know what your Jira is actually configured to do

GovernScore connects read-only to a Jira Cloud site and grades its configuration against 46 deterministic governance rules. It returns a 0-100 score, an A-F letter grade, evidence for every finding, and a prioritised list of what to fix first.

GovernScore is a SolutionsCrafters product: rules, platform and operations built and run in-house.

The GovernScore dashboard showing an overall score out of 100 with a letter grade, pillar cards for Configuration, Security and Usage each with their own score, a coverage summary, and a list of findings ordered by severity.

Context

GovernScore is built for Jira Cloud administrators, platform owners and IT governance leads: the people who get asked whether the instance is in good order and have no defensible way to answer. The sites they look after have usually run for years and been configured by many hands. Schemes have multiplied, custom fields have accumulated faster than anyone retired them, permission schemes were widened once to unblock someone and never narrowed again, filters have been shared more broadly than intended, projects have gone quiet, and licences sit with people who left.

Challenge

The instance is too large to inspect by hand and too important to guess at. Nobody can say which custom fields are still in use, which permission schemes grant more than the policy allows, or which filters are visible beyond the people who should see them. Cleanup keeps being postponed because there is no agreed picture of what is wrong and no way to rank it. A spreadsheet review goes stale the week it is finished, and two administrators looking at the same site rarely come back with the same list.

03 · Approach

Approach

The controlling decision was to keep every rule deterministic. A rule is a stated condition over configuration the scan can read, so the same site always produces the same score and every finding names the rule that raised it. The second decision was read-only by design: GovernScore inspects and reports, and holds no path to write to Jira, so it can be pointed at a production site without a change window. The third was to publish what the scan could not check. Where a check is blocked, it is named in a coverage report and excluded from its pillar average instead of being counted as a pass, so a narrowly scoped token lowers coverage rather than lifting the grade. The last decision was to make the standard itself adjustable, because a baseline nobody agrees with is a baseline nobody acts on.

System delivered

46 deterministic governance rules across weighted pillars - Configuration (23 rules), Security (8), Usage (15) - resolved into a 0-100 score and an A-F letter grade
A read-only, rate-limit-aware scan that completes in roughly four minutes, with live progress and jobs that resume after a restart
Object-centric evidence: one row per Jira object listing every rule that object trips, rather than a rule-by-rule report to cross-reference
A coverage report naming every check the scan could not run and why, with those rules excluded from the pillar average
Nine deep-dive analyzers: automation rule audit, workflow complexity, JSM and ITSM checks, scheme visualiser, licence impact, filter remediation, delta report, app inventory and Confluence governance
A remediation worklist where a finding becomes assignable work with an owner, due date, status and comments, alongside scan history, delta reports, scheduled scans and CSV or JSON export
Multi-tenant organisations with role-based access, invitations and switching between connected Jira instances, credentials encrypted at rest, and a free tier that needs no card

04 · What changed

What changed

01An administrator can state what is actually configured in the instance, and point at the rule and the object behind every answer
02The grade is reproducible: the same site scanned again gives the same result, so a score can be put in front of a steering group without an argument about how it was produced
03Cleanup starts from a ranked list instead of an opinion - the worklist says what to fix first, who owns it and when it is due
04The coverage report keeps the grade honest: a check that could not run is reported as unchecked, never as a pass
05A scan changes nothing in Jira, so a production site can be assessed without a change window or a rollback plan

Related services

Independent Atlassian Engineering Management Systems

Technology

Jira Cloud RESTDeterministic rule engineNext.jsFlask

Have a project in mind?

Let’s define the next useful version of your product

Tell us what the product must do, who it serves, and where the current process breaks. We will help shape a practical next step.

Start the conversation Back to Work

Back to Work

SolutionsCrafters product

Case study · GovernScore