CogniRunner Unveils AI-Driven License Management and Workflow Validation for Atlassian Cloud Ecosystem

The landscape of enterprise software management is undergoing a significant shift as artificial intelligence moves from simple chatbots to autonomous agents capable of handling complex administrative tasks. This week, the spotlight fell on CogniRunner, a Forge application for Jira Cloud, which demonstrated its ability to manage Atlassian licenses across sprawling organizational structures using little more than plain-language instructions. In a series of real-world drills and live deployments, the AI agent, categorized as a "Virtual Administrator," successfully audited dozens of products, proposed cost-saving measures, and operated within a strict human-in-the-loop safety framework.

Atlassian license management is traditionally a tedious, manual process or one requiring rigid, deterministic tools. CogniRunner seeks to bridge this gap by allowing administrators to describe a job in a single paragraph. During the demonstration, the agent was tasked with a specific mandate: keep every product at ten licensed users or fewer, ignore demo evaluators, protect administrative accounts, and report all findings. The results highlighted both the efficiency of AI and the necessity of granular control in modern cloud environments.

Atlassian License Management Set Up by Prompt

The core of the CogniRunner experience lies in its "Describe a Job" interface. Rather than configuring complex logic gates or writing scripts, an administrator provides a natural language prompt. In the latest tests, which spanned versions 1.32.0 to 1.33.1, the agent was given a detailed set of instructions to monitor an organization’s license usage. The prompt directed the agent to count licensed users per product across every site reachable via the Organization API, identify the least active users based on their last-seen dates, and propose the removal of access for those users if a product exceeded a ten-user limit.

Upon receiving these instructions, the agent does not act immediately. Instead, it searches CogniRunner’s internal catalog of Atlassian operations to build a viable execution plan. In this instance, the agent identified eight necessary operations. Seven of these were "read-only" actions, such as fetching site lists, user counts, and role assignments. The eighth operation—the actual removal of a user from a group—was automatically flagged with a requirement for human intervention. This "Asks you each time" designation ensures that while the AI does the heavy lifting of data gathering, the final decision to alter a user’s access remains with a human administrator.

The agent’s plan involved a 14-step process, including the creation of a daily review issue in Jira and a schedule to check for work every 30 minutes during business hours. This structured approach allows the AI to function as a persistent watchdog, maintaining a "Live" status where it reports findings autonomously while staging any requested changes for approval.

Counting Licensed Users Per Product via the Organizations API

The challenge of managing Atlassian licenses is compounded by the vendor’s billing logic. According to Atlassian’s user management guidelines, any user granted application access counts toward a cloud subscription, regardless of whether they have ever logged in. For organizations with multiple sites and products, keeping track of these "ghost" users is a significant administrative burden.

In the monitored organization, which consists of 17 test and demo sites, the CogniRunner agent was tasked with auditing 32 distinct product instances. These included various deployments of Jira, Confluence, and Jira Service Management. The agent successfully identified that user counts across these 32 products ranged from three to six licensed users—well below the ten-user threshold defined in the prompt. Consequently, the agent correctly proposed no removals during its standard run on October 9.

To verify the AI’s accuracy, manual scripts were run against the same Organizations REST API. The results matched perfectly, confirming that the AI could navigate complex API responses to provide a reliable snapshot of an organization’s licensing posture. Furthermore, the agent demonstrated a nuanced understanding of context by successfully excluding "demo evaluators"—temporary users whose access is managed by a separate process—proving that AI can handle exceptions that might trip up simpler automated tools.

Removing Inactive Users with Human Oversight

While counting users is the first step, the primary goal for many organizations is the active reduction of license costs by deactivating inactive accounts. This is a persistent pain point in the Atlassian community; a long-standing request in the Atlassian ecosystem, AX-1169, which seeks to automate the deactivation of inactive users, has gathered hundreds of votes and has been "under consideration" for years.

To test CogniRunner’s capabilities in this area, a "license drill" was initiated. The agent was instructed to reduce the user count for a Confluence site from five users to four. The agent analyzed the user list, identified two non-admin users, and selected the one with the oldest "last-active" date. It then filed a formal request to remove that individual from the site’s Confluence users group.

This request appeared in the agent’s "Atlassian Calls" tab, awaiting approval. The demonstration showed that the request was filed at 22:12:21 UTC and approved by a human administrator 18 seconds later. The API confirmed the user count dropped to four within a minute. To ensure the process was reversible, the user was added back to the group shortly thereafter. This drill underscored a critical aspect of CogniRunner’s design: the count is the proof. While the AI confirms the removal of a group membership, the organization’s API provides the ultimate verification that the license seat has been released.

Safety Architecture: Approval First and Admin Protection

A recurring concern with AI agents is the potential for "runaway automation"—an agent making unauthorized changes or, in a worst-case scenario, locking administrators out of their own systems. CogniRunner addresses these fears through a multi-layered safety architecture.

Every agent operates within one of four phases: Learn, Shadow, Ask First, or Live. In none of these phases can the AI model delete data or change identity configurations on its own. Any action that would modify the environment is converted into an approval request. These requests are role-sensitive; organization-level operations can only be approved by an organization admin, while Jira-specific changes require a Jira administrator.

Furthermore, the system includes a hard-coded "Admin Protection" list. Any operation that would negatively affect a recognized administrator—such as removing them from a group, revoking a role, or disabling their account—is automatically refused by the system before it even reaches the approval stage. This safeguard covers the Organizations API, Jira, and Confluence. The system identifies administrators by their roles and memberships in key groups like "site-admins" or "org-admins." If the AI cannot definitively determine who an operation will affect, it defaults to a refusal, prioritizing security over autonomy.

Data security is also handled at the platform level. Organization API keys are associated with the organization rather than individuals and are stored encrypted in Forge secret storage. CogniRunner only sends these keys to the official Atlassian admin API, and the system provides warnings two weeks before a key is set to expire.

The Economics of AI Tokens and Deterministic Alternatives

Running an AI agent involves a cost-benefit analysis of "token" usage. Each time an agent reads, reasons, and writes, it consumes tokens from an AI provider. In the Confluence license drill, a single turn used approximately 72,000 tokens. Depending on the model used—such as DeepSeek V4.1 Flash or Claude Sonnet 5.5—the cost can range from a few cents to nearly a dollar per run.

The developers of CogniRunner are transparent about when AI is the right tool for the job. For simple, repetitive license counting, deterministic tools are often more efficient and cost-effective. These tools do not require token expenditures and have no risk of misinterpreting a prompt. However, AI earns its keep when the task requires judgment or integration with unique organizational data—such as identifying demo evaluators based on specific Jira fields or interpreting complex backout plans.

To manage costs, CogniRunner includes a daily token cap per agent, typically starting at 250,000 to 500,000 tokens. This prevents unexpected bills while allowing the agent to perform its daily duties. Users can choose from various providers, including Anthropic, OpenAI, and Google Gemini, or even run local models via Ollama to eliminate token costs entirely.

AI Workflow Validation and "The Coder"

Beyond license management, CogniRunner demonstrated its utility in safeguarding workflows and assisting in software development. A notable experiment involved an AI workflow validator designed to stop unauthorized or unsafe transitions in Jira.

In a simulation involving a database change request, two AI validators were set up to review "Backout Plans" and "Staging Rehearsal Reports." The AI was instructed to block any transition to the "CAB Approval" status if the backout plan was not concrete or if the rehearsal report showed failed steps. When "Claude Code," an Anthropic coding agent, attempted to move the ticket via the REST API, the CogniRunner validator blocked the move. The AI correctly identified that the backout plan failed to account for a specific dropped column and that a row count verification had failed in the attached report.

This capability represents a significant advancement over traditional regex-based validators, which can be fooled by the presence of text but cannot judge its meaning. By providing a natural language "reason" for the failure, the AI allows both human and automated agents to correct their work and try again.

Finally, the demonstration featured "The Coder," an AI coding agent that can build and deploy Forge applications through Bitbucket Pipelines. From a single prompt, the agent created a Bitbucket repository, staged necessary files for a new Jira issue panel, and triggered a deployment to a development environment. Throughout this process, security remained paramount: the agent operated with restricted scopes and did not have access to personal API tokens or administrative credentials, adhering to Atlassian’s stringent security requirements for cloud apps.

As AI continues to integrate into the Atlassian ecosystem, tools like CogniRunner suggest a future where the role of the administrator shifts from manual execution to high-level oversight, directed by plain-language commands and secured by robust, multi-stage approval processes.