Governor risk-sized autonomy for GitLab Duo agents

Every change an agent makes gets autonomy sized to its risk: low-risk changes ship on their own, risky ones get fewer privileges and more verification.

T0 docs T1 low T2 elevated T3 high (restricted agent, dark launch) T4 refused

Hash chain verified: 230 entries

MR !4: removes SAST job

T4refused (T4)

MR !4 · 12 Oct 14:22:08 to 12 Oct 14:22:08 (0 s) · 1 ledger entries · raw JSON

Run timeline

Issue

skipped

Triage

skipped

Delivery

skipped

Pipeline

skipped

Canary

skipped

Promote / roll back

skipped

Close

14:22:08

GitLab DevSecOps stages this run touched

Plan

not touched

Create

MR !4

Verify

not touched

Package

not touched

Secure

not touched

Release

not touched

Configure

not touched

Monitor

not touched

Govern

ledger entries

Tier and evidence

Tier T4, 1 points. A signal's floor sets a minimum tier; points add to it. No LLM is in this decision.

SignalDetailPointsFloor
ci_config.gitlab-ci.yml0T2
ci_security_regressionsecurity include removed: Jobs/SAST.gitlab-ci.yml0T4
touched_line_coverageunknown, +1 (no coverage data yet, so the scorer assumes worse)1

Human actions

None. No person acted on this run after it started.

Ledger entries

TimeEntryKindWhat happened
Close
14:22:08L66-3c8b86f9ad36t4_decisionsigned T4 decision do_not_merge: removes SAST job