What we're asking for:

Provide a workspace-level configuration to enable and enforce merge checks (and, ideally, branch restrictions) across every repository in the workspace, such that:

1.  The policy is defined once at the workspace level (with optional narrowing at the project level).
2. The policy is inherited into every repository (including newly created ones), without needing repo-level configuration.
3. Repository and project admins can't disable or override the enforced setting;  only workspace admins (or a designated policy owner) can do so.
4. Enforcement is audit-logged so compliance teams can prove the control was in effect.
5. Optionally, allow a workspace admin to configure a bypass allow-list (specific users or groups) for exceptional cases, similar to GitHub Repository Rulesets and GitLab group Push Rules.

Why don't the existing options solve this

• Today, merge checks and branch restrictions are configured per repository. In a workspace with dozens or hundreds of repositories, this is not scalable and drifts over time.
• The Premium option "Prevent a merge with unresolved merge checks" only exists at the repository level and can be turned off by any repository administrator, which defeats the governance intent when repo admins are also the developers being controlled.
• The closest prior request: https://jira.atlassian.com/browse/BCLOUD-22024 ("Ability to enforce merge checks just for users that are not Admin"), was closed as Won't Fix in 2024 and has no live successor.
• Related tickets https://jira.atlassian.com/browse/BCLOUD-23774 (conditional bypass) and https://jira.atlassian.com/browse/BCLOUD-23976 (Forge-app bypass) address the bypass side, but not the workspace-scoped enforcement with admin lockout side.
• The signed-commit workstream (https://jira.atlassian.com/browse/BCLOUD-23997, currently In Progress) already introduces the workspace → project → repository inheritance model for one specific policy (signed commits). This request is asking Atlassian to generalize that same pattern to merge checks and branch restrictions.
  Business impact
• Enterprise security and compliance teams need a way to prove that policies such as "all changes must pass required merge checks and can't be merged with unresolved failures" are enforced consistently, in a form that a repository admin can't silently disable.
• Without this, we have to rely on periodic auditing scripts and after-the-fact detection instead of preventive control, which is not acceptable under our SOX / SOC 2 / ISO 27001 obligations.
• We currently rely on a Forge app to attempt this, but the Forge extension point only runs at pull-request time and can't enforce the underlying repository settings against a repo admin who chooses to disable a check.

Proposed acceptance criteria:

• Workspace admin can, in workspace settings, enable a set of enforced merge checks (for example, N approvals, no unresolved comments, builds passing, no changes requested).
• The setting cascades to every repository in the workspace; new repositories inherit automatically.
• Repository/project admins can view but not disable the workspace-enforced setting.
• Optional per-workspace bypass list of users/groups for break-glass scenarios; every bypass event is written to the audit log.
• Available via REST API for Terraform / IaC management, and surfaced in the workspace-level audit log.
• Gated behind the Premium plan (mirroring the existing "Enforced merge checks" gating).