4. Expanded Feature Catalog (What Jira Admins, PMOs and Auditors Ask For)
These are the features buyers in this space ask for, drawn from competitor listings, vendor comparison posts and common audit requests. Each is classified with the same honesty as the stated idea. Being in demand doesn't mean you should build it. Most of these demands are already met by someone.
Legend: TS = Table stakes, D = Differentiator, X = Distraction, L = Liability. Priority: P0 = v1 of the recommended wedge, P1 = next, P2 = later, — = don't build.
"Egress" in the notes means the feature sends data outside Atlassian, which costs the "Runs on Atlassian" badge (see 03).
A. Change-control evidence (the wedge, so lean in)
| Feature | Demand signal | Category | Priority | Notes |
|---|---|---|---|---|
| Approval evidence per change (who moved it to Approved, when, from which status) | High at audit time. Auditors sample changes and ask for approval proof. | D | P0 | The core report. Built from the changelog author on each transition. |
| Segregation-of-duties exceptions (approver = assignee, reporter or implementer) | High in SOC 2 and SOX change controls | D | P0 | The headline exception. Cheap to compute once transitions are stored. |
| Skipped-step exceptions (reached Done without passing Review or Approved) | High | D | P0 | Needs a per-project "required path" setting. |
| Audit-period sampling (random sample of N changes between two dates, reproducible seed) | Medium-high. Auditors pick samples, and teams want to pre-check them. | D | P0 | A seeded sample shows the auditor it wasn't cherry-picked. |
| Evidence pack export (XLSX + PDF, cover page, scope, filters, content hash) | High | D | P0 | Generate in async jobs (15-minute limit). The hash makes the export tamper-evident. |
| Monthly control check (exceptions this month, delivered inside Jira or to a Confluence page) | Medium, but it's the retention feature | D | P0 | The reason to keep paying between audits. |
| Time in approval, and time from Approved to Done | Medium | TS → D in context | P0 | Time in status, reused inside the audit job. |
| Emergency-change handling (approved after the fact, within N hours) | Medium, common in change policies | D | P1 | Configurable window. |
| Linked-evidence check (change links to a PR, deploy or test issue) | Medium | D | P1 | Uses Jira development-panel data where available. Test API availability on Forge first. |
| Control mapping labels (SOC 2 CC8.1, ISO 27001 change management, SOX ITGC) | Medium | TS | P1 | Labels and wording only. Never claim compliance. |
| Auditor read-only share link outside Jira | Asked for | L | — | Egress, access control and data exposure risk. Export files instead. |
B. Time in status and SLA (keep as supporting reports)
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Time in each status per issue, with business-hours calendars | TS | P1 | Needed for SLA evidence. Don't sell it on its own. |
| Status groups (e.g. "waiting" vs "working") | TS | P1 | Every leader has it. |
| Cycle and lead time charts, histograms, percentiles | TS | P2 | Leaders have 15+ report types. Don't compete. |
| SLA breach evidence for audited service desks (breaches, reasons, approvals on breached tickets) | D | P1 | Phase 2 line of revenue. |
| Transition counts and ping-pong detection | TS | P2 | Common. |
| Dashboard gadgets | TS | P1 | Expected in Jira apps. One gadget: "open exceptions this month". |
C. Roll-ups and portfolio reporting (the PMO job)
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Roll-up of estimates to parent or epic | X | — | JXL, Structure, Jira Plans, Agile Docs. |
| Cross-project progress dashboards | X | — | Sales-led, political, and well served. |
| Spreadsheet-style views with sum-ups | X | — | Appfire's JXL owns this. |
| Power BI or Tableau data feeds | X / L | P2 at most | Egress. votazz already offers a JSON feed. |
D. Issue history and audit trail (raw)
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Full field-change history export (CSV/XLSX) | TS | P1 | Expected by audit buyers. SaaSJet already sells it. |
| Deleted-issue tracking | TS / D | P2 | Only possible from events captured at the time. SaaSJet offers restore. |
| Point-in-time snapshots ("what did this look like on 30 June?") | D | P2 | Useful for audits. Storage-heavy, so watch the 1 GiB per-install limit. |
| Sensitive-data scan in issues | X | — | SaaSJet has it. It's a different job. |
| Bulk revert of changes | X / L | — | Writes to customer data. High support and trust risk. |
| Immutable, append-only log with hash chain | D | P2 | Strengthens the evidence claim. Must fit Forge storage limits. |
E. Delivery and integrations
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Scheduled reports to a Confluence page | D | P1 | Stays inside Atlassian, so the badge is kept. |
| Scheduled email reports via an external email service | TS / L | P2 | Egress, so it costs the badge. Offer it as an admin opt-in only. |
| Slack or Teams alerts | TS / L | P2 | Same egress trade-off. OBSS already offers them. |
| REST API for evidence data | TS | P2 | Wanted by larger customers. Adds support surface. |
| Vanta, Drata or other compliance-platform connectors | D / L | P2 | Could be a channel. Egress, and those vendors may build it themselves. Research first. |
F. Platform and trust
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Forge-only build (no Connect, OAuth, Forge UI) | TS | P0 | Qualifies for 0% revenue share. |
| "Runs on Atlassian" badge | TS | P0 | SaaSJet already has it. Needed to be considered. |
| Data residency matching the host site | TS | P0 | Part of the badge criteria. |
| Security self-assessment, SOC 2 or Cloud Fortified status | TS for enterprise | P2 | Leaders have them. Start the paperwork once you have 50 paying sites. Requirements not verified in this run. |
| Accessibility and dark theme | TS | P1 | Listed by competitors (votazz). |
G. AI
| Feature | Category | Priority | Notes |
|---|---|---|---|
| "Ask your Jira data" chat | X | — | Rovo and OBSS's AI assistant already do this. |
| AI-written exception explanations for the auditor | D (weak) | P2 | Only if it's grounded in the stored facts, and costs are metered. Forge LLM usage has no free allowance. |
| Rovo agent for evidence questions | TS (emerging) | P2 | SaaSJet ships Rovo agents. Follow, don't lead. |
H. Other products
| Feature | Category | Priority | Notes |
|---|---|---|---|
| Confluence page-history evidence | X for now | P2 after $10k MRR | Second app, second listing. |
| Data Center / Server version | X | — | Forge is Cloud only. |
| FDA 21 CFR Part 11 validation pack | L | — | Validation paperwork and vendor audits. A different business. |
4.1 Net effect
Of about 40 demanded features, about 10 are real differentiators for an audit-evidence app, and 7 belong in v1. Most of the rest are table stakes you'll add slowly, or other vendors' products (roll-ups, BI, raw history) you should not rebuild.