AI Catalog updates for governance and operations (opens in new tab)

GitLab 19.1 expands the AI Catalog from a manually triggered tool into a governed automation platform. New event-driven Duo Flow triggers, configuration validation, agent restrictions, and model allowlists help enterprises run AI workflows continuously while maintaining security and operational control. The release is designed to make agentic automation safer and more reliable at production scale.

Event-Driven Duo Flow Automation

• Four new triggers let flows respond automatically to GitLab events:
  • Merge request code conflicts
  • Draft merge requests becoming ready for review
  • Merge request approvals
  • New work item creation
• These triggers enable automated conflict summaries, compliance checks, deployment readiness checks, notifications, triage, labeling, and routing.
• Pipeline triggers can now filter for specific states: failure, success, or cancellation.
• Conflict-detected and draft-to-ready triggers are enabled by default.
• A beta pattern-based approval tier lets developers approve repeated tool uses for an entire session instead of approving each invocation individually.

Governance for Agents and Flows

• Instance administrators and top-level group owners gain controls over which AI content users can run.
• Disable custom agents and flows prevents users from creating or enabling custom-built content.
• Restrict the AI Catalog to your group hierarchy blocks AI Catalog items from outside the organization’s namespace, including community and third-party contributions.
• These controls help prevent unapproved agents and workflows from entering regulated or production environments.

Pre-Save Flow Configuration Validation

• GitLab now validates AI Catalog flow configurations against the Duo Workflow Service before saving them.
• Errors such as missing inputs or invalid tool parameters appear directly in the UI.
• This moves troubleshooting to configuration time, reducing the risk of broken or overly active flows running in production.

Approved AI Model Controls

• A public beta lets administrators define an allowlist of approved AI models.
• Organizations can also set an organization-wide default model.
• Teams retain flexibility within approved boundaries while meeting provider, compliance, or data-residency requirements.
• The first version applies to GitLab Duo Agentic Chat, with broader coverage planned.

Overall, GitLab 19.1 recommends treating AI workflows like production automation: trigger them from real events, validate them before deployment, and govern both the agents and models they use. Enterprises adopting the AI Catalog should configure the new restrictions and model policies before enabling widespread automated flows.