Published on: July 31, 2026
10 min read
AI agents can write, push, and deploy without human review at each step. Learn a practical framework for controlling access, permissions, and audit trails.
AI code completion built human review into the process by design. A developer types, a suggestion appears, and a human decides whether to accept it. A person looked at every line before it shipped.
Agentic AI breaks that review loop. An agent can open a merge request, call a tool, modify a CI/CD configuration, and push a change, sometimes without a person reviewing each individual step. Add in the Model Context Protocol (MCP), which lets agents connect to external tools and data sources on their own, and the question engineering leaders are asking shifts. It is no longer "which model writes the best code?" It is "what is this agent allowed to do, and how can we prove what it did?"
GitLab's own research across more than 1,500 developers and technology leaders found that 73% of respondents are concerned about the long-term maintainability of code and 86% agree that without clear governance, AI-generated code can compound technical debt faster than traditional development practice.
In this article, you'll learn how to proactively address some of the challenges organizations are starting to see with governing agentic AI. We'll introduce you to a governance framework for agentic AI in software development and explore what to control, where human review still belongs, how to measure a rollout, and a practical checklist for teams standardizing on GitLab Duo Agent Platform.
The security model for an interactive coding assistant is straightforward because a human is in the loop at every step: a developer asks a question, reviews a suggestion, and accepts or rejects it.
Agentic AI in automated workflows requires a different approach to governance. When an agent can run tests, modify configurations, and take multi-step actions across the software delivery lifecycle without a human reviewing each step, the relevant questions change to:
Most teams are already feeling this challenge. Ninety-two percent of DevSecOps professionals report some governance challenge with AI-generated code, and the specific concerns point directly to the questions above.
The top concerns include:
Once an agent is approved for a project, it can typically write, delete, and push changes without someone reviewing the action before it happens. However, you are still accountable for what lands in the codebase regardless of whether a person or an agent made the change.
Governance for agentic AI is not an add-on to code completion governance. It is a different approach, built around identity, permissions, and auditability.
Once agents can call tools and connect to external systems through protocols like MCP, permissioning becomes the control point. A useful governance model answers three questions before any agent runs:
In practice, this looks like a few layers working together:
The goal is a control plane that treats agent permissions the same way an organization already treats human permissions: role-based, auditable, and consistent across every project.
Source code is one of the most sensitive assets an enterprise has, and every AI feature that reads it raises a data-handling question. Before rolling out agentic AI broadly, engineering and security leaders typically want clear answers to a short list of questions:
For organizations in regulated industries, the answer to "where do our subprocessors sit" often needs to be "nowhere outside our own infrastructure." That is why self-hosting matters as a governance lever, not just a deployment preference. Self-hosted options let a team run its AI agents entirely on infrastructure it controls, while still accurately tracking team usage and satisfying regulators.
Bring-your-own-model support extends that further, letting administrators connect models they have already validated internally and map specific models to certain agent flows. With this method, a sensitive workflow can be pinned to a model the organization trusts while less sensitive workflows use a managed option.
Governance does not mean blocking agents from acting autonomously. It means deciding, deliberately, where autonomy ends and review begins. A workable policy usually separates two modes:
Code review, testing and validation, and deployment approval should all be defined by answering questions like:
In practice, each checkpoint needs its own enforcement mechanism. This could look like:
We recommend creating an organization-wide AI governance policy rather than leaving it to individual team norms. This helps create consistent usage and policies, and helps auditors verify your use of AI.
There is a longer-term benefit to capturing these approvals as structured records rather than letting them evaporate in a chat thread or a reviewer's memory. An exception granted last quarter, the policy version it was granted under, and who approved it are exactly the kind of organizational judgment that both auditors and future agents need to reference.
Enterprises that treat decisions as durable, queryable events get the added benefit that the next reviewer, human or agent, starts with additional context instead of starting from zero.
Learn more about the decision layer and how capturing decision events can impact your software development.
Five categories are worth tracking from the start, and they should be reviewed together rather than in isolation, since a spike in adoption without a matching look at risk metrics is itself a warning sign.
By tracking all five metrics together, you can catch issues with the AI rollout early. A rollout can look successful on adoption and acceptance while accumulating risk that only shows up in an audit six months later. With the above metrics, you get a holistic view of the value of AI to your organization.
For teams standardizing on GitLab Duo Agent Platform, here is a practical starting checklist before expanding agentic AI beyond a pilot:
Revisit the checklist each release cycle. Governance for agentic AI is not a one-time setup. New agents, new tools, and new models often reopen governance questions.
Agentic AI changes what needs governing. Code completion asked a developer whether a suggestion was good. Agentic AI asks what an agent is allowed to touch, who approved it, and whether that can be proven later.
Answering those questions fully requires governance built into the platform itself, not layered on afterward. GitLab Duo Agent Platform provides an AI Catalog, approval guardrails, and audit event streaming directly into the platform where the work happens, so governance isn't bolted on after the fact. Teams get AI-assisted speed and enterprise control together, because the guardrails are part of the workflow, not a separate process running alongside it.
Start a free trial of GitLab Duo Agent Platform. On the Free tier, you can sign up in a few simple steps. If you're already on GitLab Premium or Ultimate, you can turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
Enjoyed reading this blog post or have questions or feedback? Share your thoughts by creating a new topic in the GitLab community forum.
Share your feedbackFrequently Asked Questions
Unlike interactive code completion, where a human developer reviews every suggestion, agentic AI can perform multi-step actions — such as running tests or modifying configurations — without human intervention at every step. This shifts the focus from "which model writes the best code?" to "what is this agent authorized to do, and can we prove what it did?"
A strong governance model centers on identity, permissions, and auditability. Key components include a central catalog for managing agents and flows, composite identity (linking agent actions to the requesting human user), tool approval guardrails to manage autonomy, and prompt guardrails to prevent behavior hijacking.
Engineering and security leaders typically focus on three core data-handling questions: whether the vendor trains models on company code, who owns the inputs and outputs, and the location of subprocessors. For highly regulated industries, self-hosting options and "bring-your-own-model" approaches are often used to maintain infrastructure control and data residency.
Organizations should distinguish between "interactive" work (where a developer is present) and "automated/headless" work (such as CI/CD pipelines). Checkpoints for code review, testing, and deployment approval should be enforced through tools like merge request approval policies, tool approval guardrails, and scanner enforcement, rather than leaving governance to individual team norms.
Teams should track five integrated metrics: adoption (usage levels), acceptance and quality (revert rates and rework), risk (policy violations and guardrail interventions), remediation (vulnerability resolution time), and ROI (time saved versus costs). Monitoring these together prevents accumulating hidden risks while focusing only on adoption or efficiency gains.
Start building faster today
See what your team can do with the intelligent orchestration platform for DevSecOps.