Every finding the auditor can raise, what causes it, and what to do about it.
A page sits under an edit-restricted parent but has no edit restriction of its own, so it is editable by everyone the space allows — while looking locked in the tree.
Why: Confluence cascades view restrictions down the page tree but not edit restrictions. This is documented behaviour, not a bug: CONFCLOUD-5095 has been open since 2006. Changing it now would silently alter permissions on millions of existing pages, so it is unlikely ever to change.
What to do: if the parent's restriction was meant to protect this page too, add the same edit restriction here. Confluence will not do it for you, and it will not do it for pages added under that parent tomorrow either.
Viewing is restricted, editing is not. Everyone who can see the page can change it, which is rarely what a restricted page is for.
What to do: if the page should be read-only for most of that group, add an edit restriction naming only the people who should change it.
Confluence returns at most 200 names per restriction. Past that, we are looking at part of the list, so everything the report says about that page understates who can reach it.
What to do: review that page's restrictions in Confluence directly. A restriction naming this many principals is almost always better expressed as one or two groups — which is easier to audit as well as easier to read.
We would rather tell you the report is incomplete than quietly hand you the part we could see.
A restriction names an account that is deactivated or no longer on the site. It grants nothing today, but it hides what the restriction was meant to express, and it is the kind of thing an access review is supposed to catch.
A restriction names a group that is not on the site — usually a rename or a typo. It grants access to nobody, so the page may be far more locked down than intended.
The page is readable but no one holds edit on it. Sometimes deliberate, for a frozen policy or a signed-off record. Worth knowing which ones are deliberate.
The edit restriction already includes everyone who can view the page, so it changes nothing. Remove it to keep the permissions readable, or narrow it to the people who should actually be able to edit.
Every principal named has gone, or the only group named is empty. Space administrators can still reach the page, so it is not lost — but nobody else can, and that is usually an accident.
Two gates, both of which have to pass. A person needs the space permission for the operation, and then must be allowed by the page restriction if one exists. Someone named on a page restriction who lacks the space permission cannot do it, and the report counts them out.
Groups are resolved to the actual people, because "the legal group can edit this" is not something an auditor can sign off. Broad grants that cannot be expanded to a person list — "all licensed users", anonymous access — are reported as themselves rather than expanded into hundreds of names or, worse, dropped.
One case cannot be expressed by Confluence's API at all: an unrestricted page and a page restricted to nobody come back identical. We read that as unrestricted, which is what it is in practice.
Read scopes only. The app cannot alter a permission or a restriction, and we will not add that — "your app changed my restrictions" is a conversation we have chosen never to have.