It depends on the plan. Anyone can suggest merge checks, but without Premium people see warnings for unresolved checks and can still merge. Premium lets you block merges that fail checks and adds approval reset options. Workspace admins set up custom checks, working alongside branch permissions.
The checks on offer
Atlassian lists these merge checks on all plans:
- Minimum number of approvals, and a minimum from default reviewers.
- No changes requested.
- No unresolved pull request tasks.
- Minimum successful builds for the last commit, with no failed or in-progress builds.
- Maximum number of commits behind the destination branch.
- Reset requested changes when the source branch is modified.
- Allow automatic merge when builds pass.
Premium adds resetting approvals when the source branch changes, keeping approvals if the diff is unchanged, and preventing a merge with unresolved checks.
Warn versus block
This is the point that matters in a review. Without Premium, an unmet check produces a warning, not a stop. A person in a hurry can merge anyway. If your policy says reviews are mandatory, a warning does not meet it.
Check which plan your workspace uses before you describe a control as enforced in a questionnaire.
Branch permissions and merge checks
Atlassian describes them as working in tandem. Branch permissions decide who can write to or merge into a branch. Merge checks decide what a pull request must satisfy. A sensible pattern restricts the main branch to named merge users and adds an approvals and builds check, while a development branch gets a group with lighter checks.
Configure restrictions from repository settings, under Workflow, then Branch restrictions. Add the pattern, set write and merge access, then add the checks.
A quick audit
- Open branch restrictions on your release branch.
- Note whether checks are required or only suggested.
- Confirm who may merge and whether that list contains admins, bots and contractors.
- Test with a pull request that fails a build, and see whether the merge button is blocked.
- Record the result with a date.
A tested block is evidence. A setting you believe is on is only a belief.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo and see what a hard gate looks like, then compare it with a warning that can be clicked past.
Click through it at your own pace, or open it full screen.
Quick check
Who can set up custom merge checks?
Atlassian says the Workspace admin role is required.
Does Premium change approvals?
Yes, it adds options to reset approvals on source branch changes or keep them when the diff is unchanged.
Sources
Last reviewed: 19 October 2026.
