What is it?
GitLab Duo is GitLab's family of AI-assisted software-development capabilities spanning developer assistance, code review, explanations and broader agentic workflows. The GitLab Duo Agent Platform introduces agents and flows that can work with software-development context across GitLab.
GitLab's AI direction has moved beyond isolated code suggestions towards AI-assisted and agentic workflows embedded across the software-development lifecycle. That creates more potential value, but also raises the governance requirement. Organisations need to decide what AI can access, what actions it may take, what humans must approve and what evidence is retained.
Use this approach when evaluating or expanding GitLab Duo adoption, when defining AI governance for software delivery, or when the underlying delivery controls need strengthening before broader AI autonomy is appropriate.
Why it matters
Risks
- AI agents that inherit unlimited authority can access repositories, trigger deployments or process credentials beyond what the task requires.
- Human in the loop without defined decisions creates performative oversight where people approve output they have not actually reviewed.
- AI that creates a second path around governed delivery bypasses the controls the organisation trusts for security, quality and compliance.
Costs
- Enabling AI everywhere without specific use cases creates adoption theatre where usage metrics rise without measurable engineering improvement.
- AI-related incidents or policy violations that occur without audit evidence are expensive to investigate and difficult to explain to regulators.
- Expanding AI autonomy before the delivery baseline is stable means AI can accelerate chaos while making attribution harder.
Operational impact
- Without identity and permission boundaries, AI agents inherit broad access to repositories, credentials and infrastructure that exceeds what the task requires.
- AI workflows that process sensitive source code, customer data or secrets without documented data boundaries create uncontrolled exposure.
- Teams that cannot inspect what an AI workflow did, what context it used and what actions occurred lose traceability for regulated or high-trust systems.
Strategic impact
- Competitors that govern AI effectively can expand its use and gain productivity while ungoverned organisations accumulate risk and policy violations.
- Regulated organisations that cannot explain their AI boundaries, permissions and evidence face increased scrutiny from audit and compliance functions.
- Organisations that wait for perfect governance miss the productivity benefit, but those that adopt without governance accumulate unmanaged risk.
GitLab AI adoption framework
Select specific use cases
- Choose one or two engineering problems worth solving: reducing time on unfamiliar code, improving first-pass review, interpreting security findings, reducing documentation work or accelerating pipeline failure investigation.
- Each use case should have a measurable baseline and an accountable owner.
Bound permissions and data
- Define repositories, data categories, identity, permissions and prohibited use before enabling features.
- Document which model and hosting arrangements are in use, applicable retention settings and organisational restrictions.
- Review whether secrets, sensitive customer data or intellectual property can enter AI context.
Validate with existing controls
- Keep deterministic tests, security scanning and human review in place.
- Generated code should still enter source control. Changes should still be reviewed. Tests and security scanning should still run. Environment promotion should still follow policy.
Observe AI activity
- Use available session information, logging and governance evidence to understand what AI workflows did.
- The objective is traceability: what initiated the workflow, what context it used, what actions occurred, what human decisions followed and what ultimately shipped.
Measure engineering outcomes
- Evaluate using evidence tied to the use case: task completion time, review latency, accepted versus rejected suggestions, rework, escaped defects, security remediation, developer satisfaction and AI-related incidents.
- Avoid a single productivity metric. More code is not necessarily more customer value.
Expand deliberately
- Increase scope or authority only when the evidence justifies it.
- This staged approach is slower than switching everything on. It is also much easier to defend and improve.
Common mistakes
Enabling AI everywhere without specific use cases or measurable baselines
Consequence: Usage metrics rise without demonstrating engineering improvement, creating adoption theatre that cannot justify the governance investment.
Avoidance: Select specific engineering problems, define measurable baselines and evaluate outcomes against those baselines before expanding scope.
Granting AI workflow execution authority without explicit identity and permission boundaries
Consequence: AI agents inherit broad access to repositories, credentials and infrastructure that exceeds what the task requires, creating security exposure.
Avoidance: Define an authority model. Ask what identity performs each action, which repositories it can access, which credentials are available and whether actions are recorded.
Rolling out AI to teams without mature delivery practices
Consequence: AI accelerates existing chaos while making attribution harder. Teams cannot determine whether AI is improving or degrading the system.
Avoidance: Pilot with teams that already have good merge discipline, reliable automated tests, clear code ownership and stable CI/CD. These controls make evaluation possible.
Best practices
- Use cases are specific with measurable baselines.
- Data boundaries document what AI may access.
- Authority levels define explain, suggest, modify and execute permissions.
- Human accountability is explicit for each decision type.
- Deterministic tests and security scanning remain in place.
- AI does not bypass the governed delivery process.
- Session and audit evidence is available for AI activity.
- Identity and permissions treat AI as a new actor, not a reason to relax controls.
- Measurement tracks engineering outcomes, not just feature adoption.
- Expansion requires evidence that existing controls are effective.
- FinTech and HealthTech contexts preserve accountability for sensitive changes.
Tools and processes
- GitLab Duo AI-assisted development capabilities
- GitLab Duo Agent Platform for agentic workflows
- AI authority model (explain, suggest, modify, execute levels)
- Session logging and AI governance evidence
- Engineering outcome metrics for AI evaluation
How to get started
- Select one or two specific engineering problems where AI assistance could reduce effort or improve feedback.
- Define data boundaries: which repositories may use AI, what context is processed, what restrictions apply.
- Define the authority model: explain only, suggest, modify artefacts or execute workflow actions.
- Ensure deterministic tests, security scanning and human review remain in place alongside AI capabilities.
- Pilot with teams that have mature delivery practices, reliable tests and clear ownership.
- Measure outcomes against baselines for a defined period before deciding whether to expand scope or authority.
If the underlying delivery controls are inconsistent, improve those first. AI is easier to govern and measure when teams already have reliable pipelines, testing, reviews and ownership. If delivery practices are mature, start with a bounded pilot on a specific use case.
How KineticSkunk helps
KineticSkunk positions AI-assisted GitLab delivery within the same operating model as CI/CD, software quality, security and cloud governance, helping teams determine where AI assistance is useful, where human review must remain explicit and how AI activity fits into controlled software delivery.
The objective is governed AI adoption that expands productivity without undermining the delivery, security and compliance controls the organisation depends on. For teams whose underlying DevSecOps controls are inconsistent, improving those controls may be a better first investment than expanding AI autonomy.
If you are adopting GitLab Duo and agentic AI, explore AI-Assisted Delivery Governance or take the DevSecOps Maturity Assessment to establish whether the delivery foundation is ready for broader AI workflows.
Frequently asked questions
It is GitLab's AI-native platform for agentic software-development workflows. It supports AI agents and multi-step flows that can work with GitLab development context.
The important distinction is workflow context and integration. GitLab Duo capabilities can operate within GitLab development activities such as merge requests and related software-delivery workflows rather than requiring every task to be moved to a separate assistant.
Only when an organisation has explicitly designed, justified and tested that authority. For many systems, production deployment should continue to require existing policy, approval and environment controls.
Define permitted use cases, data boundaries, identities, permissions, human approvals, testing requirements, auditability and risk ownership. These technical controls should support, not replace, appropriate legal, privacy, security and compliance review.
Usually not at scale. AI is easier to govern and measure when teams already have reliable pipelines, testing, reviews and ownership. Poor delivery controls make it difficult to distinguish AI productivity from additional risk and rework.
