Which spaces can this group reach, and which pages are locked?

Confluence indexes permissions by space, so the reverse question has no answer in the product. AccessLens answers it — by group, by user or by space, with group membership expanded so what you see is effective access — then adds the part Confluence makes hardest to self-check: page restrictions, and what inherits them. Freeze the result as a snapshot, diff any two quarters, sign the review off. Read-only, and nothing leaves Atlassian.

Coming to the Atlassian Marketplace Read-only: no write scopes at all. Audit data never leaves your Atlassian tenant.

Three questions Confluence cannot answer about itself. Which spaces can this group reach? No interface anywhere lists it. Who had access on a given day, and who changed it? The native audit log is an event stream, not a state. Which pages are locked, by whom, and why can I not see one? There is no list of restricted pages, restrictions inherit downwards, and they can only narrow space permissions and never widen them — so a restriction naming a group with no space access grants nothing at all, the reverse of what the admin who typed it believed.

The first two exist on the Jira side too, where the request has been open since 2019 with over a thousand votes and remains unresolved. The third is Confluence's own, and it is where every app in this category stops.

What it does

Answer who can reach what

Reverse lookup in three directions — by group, by user or by space — with group membership expanded to effective access. A lookup by user keeps every inheritance path, not just the first one found.

Find every locked page

Restricted pages per space, the restriction type, and the inheritance source — because a page is often hidden by an ancestor rather than by itself.

Findings, not just facts

Five classes of restriction problem: restrictions that grant nothing, pages only one person can read, edit-only restrictions, restrictions naming individuals rather than groups, and pages hidden by an ancestor.

A snapshot is audit evidence

Capture the whole site's permission state, manually or on a schedule. Large sites finish because the scan is sharded and resumable — the cursor reaches inside a single space, page by page.

Diffs an admin can read

Compare any two snapshots, reported one row per space and subject. Five administrative changes read as five rows, never as fifty permission lines.

Reviews that are signed

Confirm or flag space by space. Each decision carries the reviewer's Atlassian account id and a server-side UTC timestamp, and the review freezes once signed. Every view exports as CSV.

A quarterly access review, end to end

The snapshot is already there

A scheduled scan captured the site last night. Before it ran, AccessLens said what it would cost in Confluence API points and what share of the shared hourly quota that is — so nothing surprises anyone.
Read the diff, not the whole site

Compare against last quarter's snapshot. One row per space and subject: the contractor group that gained three spaces in June is one line, not nine.
Check the pages, not just the spaces

The restriction audit lists every locked page in the spaces under review, including the ones hidden by an ancestor rather than themselves — and flags the restrictions that grant nothing because the group named in them cannot see the space.
Sign it and keep it

Confirm each space or flag it with a note. The sign-off records the reviewer's account id and a server-side UTC timestamp, then freezes. Export the CSV into the evidence pack and the quarter is closed.

Against what you have today

Question	Native Confluence	Permission viewers	AccessLens
Which spaces can this group reach?	No interface for it	Per-space views	By group, user or space
Is that answer effective access or just the grant list?	—	Usually the grant list	Membership expanded
Which pages are restricted?	No list anywhere	Rarely covered	Per space, with findings
Is this page hidden by itself or by an ancestor?	—	—	Named, per page
What did access look like last quarter?	Event log, not state	Live view only	Snapshots and diffs
Evidence a reviewer signed?	—	Varies	Account id and UTC timestamp
Does audit data leave Atlassian?	—	Depends on the vendor	Never — and read-only

Three restraints, on purpose

Each of these is the opposite of what a tool normally does, and each one exists because the people who buy an audit tool are exactly the people a convenient default would hurt.

At the retention limit it refuses a new snapshot rather than evicting an old one. No automatic rotation. An audit record destroyed without anyone asking is worse than a scan that declines to run and tells you why.

When it cannot read something it marks the snapshot partial instead of quietly reporting less. A clean report that was never complete is the most expensive thing an audit tool can hand you.

Where a tenant cannot expose anonymous access at all, it says the access is not observable here — not “none found”. Confluence's tenant permission models differ, and on some of them the only endpoint that ever reported anonymous access has been removed. AccessLens measures whether it could observe it, and reports that measurement rather than an absence.

Also, structurally: the app is read-only. It declares no write scope of any kind. It cannot create, change or delete a space permission, a page restriction, a page or a comment, even if it were asked to.

Availability

AccessLens for Confluence is built and deployed on Atlassian Forge. It is going through Atlassian Marketplace review; this page will link to the listing as soon as it is live.

It is the Confluence sibling of AccessLens for Jira, which is live on the Marketplace today: the same snapshot, diff and sign-off semantics, with page restrictions added.

Licensing is handled by Atlassian. Sites with 10 users or fewer are free with every feature; paid tiers are priced per user, in step with the Jira edition.

Questions, bug reports and feature requests: raise a support request.

Found a security issue? Please report it privately rather than in a public channel.