Agentic automation in practice: putting standard engineering work on autopilot
Atlassian demonstrates how engineering teams can automate repetitive security fixes using a three-part agentic system that schedules, executes, and verifies work without manual intervention.
Teams often spend time on predictable tasks like fixing security vulnerabilities, which follow a standard process but disrupt workflows through constant context switching. Atlassian’s system replaces this manual effort with three automated components: a dispatcher that identifies work, a coding agent that applies fixes, and a closer that confirms deployment. The setup uses Bitbucket Cloud with Agentic Pipelines, where each agent is defined as a pipeline step invoking Rovo Dev non-interactively, with prompts and skills stored in the repository for review alongside application code.
The dispatcher operates as an agent rather than a simple rule-based system, making decisions about which work items to handle automatically or defer for manual review. It runs daily before working hours, ensuring fixes are ready for team review by the start of the day. The coding agent receives selected work items and applies fixes using a thin prompt that references a reusable skill containing codebase-specific guidance, such as dependency locations and fix patterns. This skill encodes institutional knowledge as a decision tree, allowing the agent to follow precise instructions rather than guessing solutions.
The closer verifies whether fixes are successfully deployed by confirming that changes are merged and included in the deployed build before transitioning tickets to a final state. It avoids false positives by leaving items open if evidence is missing, and the workflow is designed to be idempotent to prevent duplicate actions. Engineers only need to review pull requests, while the system handles execution and verification autonomously. The approach shifts engineers from performing repetitive tasks to focusing on decision-making and oversight.
The system’s reliability depends on specialized prompts and skills tailored to each codebase, stored in the repository for versioning and improvement. Atlassian emphasizes that generic prompts are insufficient; teams must iterate on real runs, track first-run merge rates, and enforce validation rules like requiring passing tests before opening pull requests. Continuous refinement and idempotent design ensure the system remains safe and effective over time.