GitLab Duo CLI: Governing AI Agents in CI/CD Pipelines

GitHub recently added bring-your-own-key (BYOK) support and local models to Copilot CLI. Developers can route requests through their own provider or run a model entirely offline. But choosing a model is only the beginning. The real complexity starts when AI begins taking actions across your entire software delivery pipeline: launching builds and changing CI/CD configuration. That is where the architectural decisions underneath a CLI tool become critical.

Two approaches to CLI AI

Copilot works at the level of an individual developer's workstation. GitHub has not provided organizational governance: there is no control over which model a team uses, and no audit of what exactly the agent did and why.

GitLab Duo CLI is designed differently. It is built on the GitLab Duo Agent Platform and is intended both for a developer with a terminal and for teams where agents automate security, verification, compliance and deployment across dozens of projects with different release cycles.

GitLab Duo CLI supports a headless mode: non-interactive, scriptable, and built into CI/CD pipelines. Governance here applies all the way to the end of the pipeline.

Why choosing a model is not the same as governance

The first generation of AI coding tools was optimized for the interactive session: a developer asks a question, sees a suggestion, and approves or rejects it. Security is simple here, because a human is present at every step.

When an AI agent works in an automated workflow, everything changes. The agent can run tests, change configuration, and perform multi-step actions across the whole software delivery lifecycle without a human checking each step. Security requirements change. The question is no longer "which model is it?" but a very different set of questions:

• What does this agent have access to?
• What is it allowed to do?
• What actions did it perform, and can I prove it?
• Can the agent be hijacked through prompt injection?

GitLab Duo CLI addresses this at the platform level. In interactive mode, no action runs without human approval. Prompt injection detection is built into the GitLab Duo Agent Platform and blocks attempts to hijack the agent with malicious commands. Composite identity limits the agent's access to only what it is explicitly authorized to do. Every AI action becomes auditable. Files such as AGENTS.md and SKILL.md let a team define precisely which tasks and actions the agent is permitted to perform.

The key scenario: CI/CD automation

CLI AI delivers the most value when debugging a broken pipeline at the end of a sprint and on multi-step development tasks. But this is also the scenario where per-developer configuration and platform-level governance diverge the most.

When an agent runs inside a pipeline, no developer is nearby, so no one can spot a prompt injection attempt or unexpected model behavior. Security controls must be built into the platform and work the same way across all workflows and environments.

What this means

For engineering leaders, this means asking the right questions: does the tool require enterprise-level control? Will the security model hold when nobody is watching? Model flexibility and offline support matter, but it is the governance architecture beneath them that decides whether you can run such a tool in production.