CogniRunner Unveils AI-Driven License Management and Workflow Validation for Atlassian Cloud Ecosystem

Removing Inactive Users with Human Oversight

While counting users is the first step, the primary goal for many organizations is the active reduction of license costs by deactivating inactive accounts. This is a persistent pain point in the Atlassian community; a long-standing request in the Atlassian ecosystem, AX-1169, which seeks to automate the deactivation of inactive users, has gathered hundreds of votes and has been "under consideration" for years.

To test CogniRunner’s capabilities in this area, a "license drill" was initiated. The agent was instructed to reduce the user count for a Confluence site from five users to four. The agent analyzed the user list, identified two non-admin users, and selected the one with the oldest "last-active" date. It then filed a formal request to remove that individual from the site’s Confluence users group.

This request appeared in the agent’s "Atlassian Calls" tab, awaiting approval. The demonstration showed that the request was filed at 22:12:21 UTC and approved by a human administrator 18 seconds later. The API confirmed the user count dropped to four within a minute. To ensure the process was reversible, the user was added back to the group shortly thereafter. This drill underscored a critical aspect of CogniRunner’s design: the count is the proof. While the AI confirms the removal of a group membership, the organization’s API provides the ultimate verification that the license seat has been released.

Safety Architecture: Approval First and Admin Protection

A recurring concern with AI agents is the potential for "runaway automation"—an agent making unauthorized changes or, in a worst-case scenario, locking administrators out of their own systems. CogniRunner addresses these fears through a multi-layered safety architecture.

Every agent operates within one of four phases: Learn, Shadow, Ask First, or Live. In none of these phases can the AI model delete data or change identity configurations on its own. Any action that would modify the environment is converted into an approval request. These requests are role-sensitive; organization-level operations can only be approved by an organization admin, while Jira-specific changes require a Jira administrator.

Furthermore, the system includes a hard-coded "Admin Protection" list. Any operation that would negatively affect a recognized administrator—such as removing them from a group, revoking a role, or disabling their account—is automatically refused by the system before it even reaches the approval stage. This safeguard covers the Organizations API, Jira, and Confluence. The system identifies administrators by their roles and memberships in key groups like "site-admins" or "org-admins." If the AI cannot definitively determine who an operation will affect, it defaults to a refusal, prioritizing security over autonomy.

Data security is also handled at the platform level. Organization API keys are associated with the organization rather than individuals and are stored encrypted in Forge secret storage. CogniRunner only sends these keys to the official Atlassian admin API, and the system provides warnings two weeks before a key is set to expire.

The Economics of AI Tokens and Deterministic Alternatives

Running an AI agent involves a cost-benefit analysis of "token" usage. Each time an agent reads, reasons, and writes, it consumes tokens from an AI provider. In the Confluence license drill, a single turn used approximately 72,000 tokens. Depending on the model used—such as DeepSeek V4.1 Flash or Claude Sonnet 5.5—the cost can range from a few cents to nearly a dollar per run.