GitLab 19.3 puts agent runtime, inference models and secrets under one permission model

GitLab has told Dedicated customers they can now run the Duo Agent Platform inside the same single-tenant environment and region that already carries their most sensitive delivery workloads, connect their own models for inference, and keep AI-processed data inside their existing security boundary ^[1]. The announcement, reported by Help Net Security on August 21, 2026, matters less for what the agents write than for where they run and what they can reach ^[15].

The mechanism is the AI Gateway for the Duo Agent Platform, which now runs inside GitLab Dedicated's single-tenant SaaS infrastructure so that agentic workloads follow the same residency and isolation model as the rest of the software development lifecycle in GitLab ^[4]. Manav Khurana, GitLab's chief product and marketing officer, framed the release as extending existing control rather than adding capability: "Every capability we shipped this month, from where an agent runs to which secret it can touch, extends that same control into the trusted software delivery workflows enterprises already depend on" ^[5]. That framing is the useful part. An auditor who has already signed off on a Dedicated tenant has a shorter conversation about an agent in that tenant than about an agent calling out to a shared gateway.

GitLab 19.3 also ships Secrets Manager, the Flow Creator Agent, and bulk SAST false positive detection with agentic SAST vulnerability resolution ^[2]. On secrets, GitLab says every secret now runs under the same permission model whether it is used inside a pipeline or by infrastructure outside it ^[3]. Each CI secret is scoped to the environment, branch, and protection status of the job that needs it ^[7], and the manager supports Kubernetes, Terraform, OpenTofu, and custom tools ^[8]. Secrets Manager is in limited availability as a paid add-on billed through GitLab Credits for GitLab.com customers, and the announcement puts no other price on it ^[6].

The backlog work is more conventional. Teams select multiple findings in the Vulnerability Report, GitLab returns a confidence score for each, and confirmed risks come back as a ready-to-merge fix for a developer to review rather than write ^[9]. GitLab says this covers every SAST vulnerability in the report and that it continues to triage and remediate new critical and high severity findings automatically ^[10]. Confidence scores are the pressure point: a bulk action is only as good as the review board's willingness to accept a machine's triage on findings it never looked at.

Flow Creator Agent removes the manual schema mapping step, letting a user describe an automation in plain language through Agentic Chat and get back a runnable flow ready to register from the AI Catalog ^[11]. The control that matters here is downstream of the convenience: every flow runs under a scoped service account with composite identity, and enabling one requires the Maintainer role or higher ^[12]. Alongside that, GitLab Credits usage caps are now generally available, with a subscription-level ceiling set in the Customers Portal plus default or per-user caps through the GraphQL API ^[13], and restricted visibility for custom agents and flows per group is generally available in addition to per-project and public options ^[14].

Two of the pieces here are generally available and the secrets layer is not ^[16]. Watch whether Secrets Manager exits limited availability with pricing that survives procurement, whether the composite-identity and Maintainer gate on flows holds up when process owners start generating them at volume, and whether the confidence scores behind bulk remediation are exportable as evidence. Competitors selling AI coding features into regulated buyers will now be asked where the inference runs and which secret the agent can touch.