Ship faster.
Keep security in the gate.
AgentTrust Gate combines deterministic policy checks with advisory AI security review to help identify risky changes to GitLab CI/CD configuration. The policy engine decides BLOCK or ALLOW; AI provides context for human review.
Policy gate scenarios
Select a scenario to inspect the recorded policy-engine result or the corresponding GitLab evidence.
Security scanner bypass
Baseline versus malicious example
What happened?
The proposed configuration replaces a real dependency scan with a message that merely claims the scan passed.
Policy evidence
- Protected job script modified: security_scan
- Protected security job modified: security_scan
- Security job script modified: security_scan
Evidence and reproducibility
{
"decision": "BLOCK",
"violations": [
"Protected job script modified: security_scan",
"Protected security job modified: security_scan",
"Security job script modified: security_scan"
]
}
This is a recorded result generated locally by the repository's policy engine using examples/baseline.yml and examples/malicious.yml. This website does not execute arbitrary YAML or run the policy engine on its server.
How the system works
- Deterministic policy engine: compares baseline and proposed CI configuration for protected changes.
- GitLab Duo review: provides advisory analysis based on available merge-request and pipeline evidence.
- Human oversight: AI does not approve or merge changes, and cannot override the policy decision.
Prototype notice: this showcase presents reproducible local example output and links to real GitLab evidence. It is not a production security boundary. Review the repository documentation for limitations.