Where should AI tool access approvals and audit evidence live: JSM, IAM, or Security/GRC?

[Andrew]

Hi all,

I’m trying to understand how Atlassian/JSM teams are handling employee access to AI tools like ChatGPT, Claude, Copilot, Rovo, Perplexity, etc.

For organizations using Jira Service Management internally, where does this workflow usually belong?

- JSM request type + approvals
- JSM Assets/service catalog
- IAM/IGA / Okta / Entra
- Security/GRC
- Procurement/legal
- Some mix of the above

The specific lifecycle I’m curious about is:

1. employee requests access to an AI tool
2. someone approves or denies it
3. access has an expiry/recertification date
4. evidence is kept for audit/security review
5. access is actually removed or renewed later

For teams that have dealt with this: is native JSM usually enough, or does the workflow break down once expiry, recertification, evidence, and identity-provider access get involved?

I’m an Atlassian Marketplace developer, but I’m not looking to pitch anything here. I’m trying to understand the real operating pattern from Jira/JSM, IAM, and security teams.

[Jean Horn]

Hello @Andrew ,

For this case, I see that the flow you presented is already within the scope of native JSM, as you mentioned.

Regarding access, I see that it can be implemented through automation flows with a trigger when the request is approved. Since some identity providers like Azure have integration with Jira Automation.

This would be my view based on your comment. I hope it helps you.

Best Regards,

Jean Horn