Atlassian today rolled out new offerings designed to make it easier for IT to differentiate coding by AIs from human coding. The problem is that such distinctions in the enterprise today are rarely binary, as much coding has lots of each.
The lack of meaningful visibility into code origin is a massive problem for most large businesses, said Jamil Valliani, head of AI products at Atlassian, in an interview. “For most enterprises, this is what is holding them back from further adopting AI.”
Atlassian’s new offering is dubbed Agentic Multiplayer Protocol (AMP), which the company described as its “foundation for how humans and agents collaborate across the Atlassian platform,” defining how agents “take part in multiplayer work with an identity, scoped authority, shared context and tasks, and results you can review.”
It includes Teamwork Graph, which Atlassian said indexes source code down to functions, symbols and classes, allowing coders to more easily search across Bitbucket and GitHub without cloning a repo. The vendor also said that Teamwork Graph provides full attribution and accountability, including version history that shows exactly what a human wrote versus what an agent did, across Claude, Codex, Figma, and Rovo.
As well, a new mode in Rovo Chat, Rovo Work, handles complex, multi-step tasks with human oversight to review and approve them. It executes across Jira, Confluence, and connected tools, and can run for hours in a secure sandbox to achieve the goal approved by the user. And a geographic feature called EU AI Inference restricts LLM processing exclusively to models hosted within the EU, the vendor claims.
Atlassian said that those capabilities are available immediately.
The announcement also described some promised non-human identity (NHI) capabilities, including controls examining what is visible to AI, and providing restrictions on what access can be granted to agent accounts and other forms of NHI. Those capabilities, Atlassian said, will roll out “soon.”
Analysts and consultants generally said that the move toward greater code origin visibility is good, but that it’s unclear whether the Atlassian offering will deliver enough meaningful context to make it useful.
Adam Resnick, a research manager at IDC, noted, “the potential value is substantial, particularly as agents take on more autonomous work.”
But, he stressed, “the real value goes beyond knowing who typed a given line. Enterprises want visibility into where humans and agents exercised judgment on consequential decisions, such as which data store to adopt or how to handle authentication. The most useful provenance shows whether meaningful human review took place, rather than simply recording that someone clicked approve.”
That more sophisticated visibility, Resnick said, “gives organizations a basis for risk-based review, rather than a blanket rule for AI-generated code. A small, well-scoped agent change may warrant lighter review than a human-written change to a payments system. Origin is one input, alongside the degree of agent autonomy, the consequence of the change, and evidence of human oversight.”
Indeed, he said, “separating AI and human contributions is one of the hardest problems in AI software engineering intelligence.” And it involves how most enterprises are using agentic development today.
Git, for example, records an author and a committer, “so when a developer runs an agent locally, the record names the developer. Attribution usually lives in commit message text, which developers can disable, edit, or lose when history is rewritten,” Resnick pointed out. “Conventions vary from one vendor to the next. And developers routinely edit agent output, so human and AI work ends up mixed together. And many organizations run several agents side by side.”
Mike Wilkes, enterprise CISO at Aikido Security, agreed. “Git can tell you who committed a change, but that is increasingly different from who, or what, actually wrote the code,” he said. “A developer might accept Copilot suggestions, paste code from ChatGPT, delegate a task to Claude Code, or have an autonomous agent create a pull request. By the time that code reaches the repository, much of that provenance has been flattened into a human identity and a commit.”
Wilkes and others said that unraveling the complexity of the code’s history will make a massive difference for a CIO trying to make funding and AI strategy decisions.
“Reliable attribution lets CIOs finally measure agentic development rather than merely count AI licenses and token consumption,” Wilkes said. “We could compare human versus agent-assisted changes on cycle time, review effort, rework, defects, rollbacks and ultimately calculate cost per accepted change.”
Doing so, and organization might discover that agents produce 40% of its changes, but only 10% of its engineering value, or exactly the opposite. “That turns AI attribution from an interesting version control feature into a telemetry layer for understanding whether millions of dollars of enterprise AI investment are actually impacting real SDLC productivity,” he said.
Added Justin Greis, CEO of consulting firm Acceligence: “If I want to know whether AI is making a developer more effective, I probably do not need to inspect every line of code for AI provenance. I can look at cycle time , defect rates, rework, throughput, security findings, and ultimately the quality and economics of what that developer produces before and after adopting the tool.”
And Frank Dickson, principal analyst at Dickson Research, noted that Atlassian said that some of the capabilities are available now and other are only said to be ready “soon.” The not-yet-ready capabilities, Dickson said, are the far more valuable ones.
“The labeling alone is thin as a differentiator. The identity control plane beneath it is where the real value may sit. Atlassian labels that piece ‘soon,’” Dickson said. “One phrase deserves scrutiny. Atlassian says it traces every change back to the agent and ‘the person who set it up.’ The person who set up an agent is not always the person who approved its work. They may sit on different teams. The person who approves an agent’s work owns it. Version history should make that ownership visible, not blur it.”
He offered an example of useful attribution.
“An agent acting with a person’s credentials gets recorded as that person,” he said. “A developer who accepts an AI suggestion and commits it signs it as their own work. A human who rewrites three lines of an agent’s code creates a change that belongs to both of them.”
“Most enterprises cannot untangle that today,” he noted. “Many do not try. Attribution is easy at the edges; [but] it is hard in the middle, where most of the work now happens.”