Security Risk Management: Security Policies 18.2 Planning Issue

Previous planning issue: Security Risk Management: Security Policies 18.... (#541387 - closed)

Narrative

In %18.1, we successfully completed and released Variable precedence controls in pipeline execut... (&16430 - closed), which provides users with greater flexibility in managing their pipeline configurations. We made progress on Security policy audit events (&15869 - closed), though this work will continue into %18.2 for completion.

We also made significant advancement on Centralized Security Policy Management (Beta) (&17392 - closed), where backend work is progressing well on both API and database sides. Additionally, we continued our frontend work on Scan Execution Policy Templates (&11919 - closed) since the backend was already delivered, and made substantial progress on Exceptions and Bypasses in Merge Request Approv... (&14090), which we've strategically split into focused epics: Source branch pattern exceptions for MR Approva... (&18113 - closed), Service Account & Access Token Exceptions for M... (&18112 - closed), and User and Group Exceptions in MR Approval Policies (&18114). We're making continously progress on both backend and frontend implementations for the first two epics scheduled for %18.2 delivery.

For %18.2, our primary focus is on completing, testing, measuring, and releasing our committed epics. This is absolutely critical - all mentioned epics above are committed deliverables for this milestone, which includes comprehensive testing, metrics implementation, and enabling feature flags by default. We need to ensure early completion in the milestone to provide adequate time for addressing any issues discovered during testing.

This will be a challenging milestone with substantial deliverables across multiple complex epics, but I'm confident that with our team's dedication and focus, we will complete our committed items on time. To ensure quality delivery, DRIs are responsible for extensive testing of their features. I strongly suggest implementing dedicated testing practices: create comprehensive test scenarios, ask colleagues to perform cross-testing of your work, and consider organizing a dedicated bug bash day. Early identification and resolution of issues will be key to meeting our commitments.

Let's work together with focus and determination to deliver these important features to our customers!

Priorities

To release

Security policy audit events (&15869 - closed)

Target release: %18.2

DRI: @imam_h Backup DRI: @mc_rocha

We need to complete this epic including enabling all feature flags simultaneously and thoroughly testing the features. An important consideration is evaluating potential performance risks as we're introducing new types of audit events to the system.

Centralized Security Policy Management (Beta) (&17392 - closed)

Target release: %18.2 (Beta)

BE DRI: @mcavoj Backend backup DRI: @sashi_kumar
FE DRI: @aturinske

We're releasing this as a Beta feature until the Compliance team is ready with their component. Our focus includes API additions, validating performance implications on GitLab infrastructure, comprehensive documentation, and initiating frontend development work.

Scan Execution Policy Templates (&11919 - closed)

Target release: %18.2

BE DRI: @alan Backend backup DRI: @bauerdominic
FE DRI: @aturinske

With backend implementation complete, we need to adapt the frontend to the newest designs, enable feature flags, and conduct thorough testing before release.

Exceptions and Bypasses in Merge Request Approv... (&14090)

Target release: %18.2

BE DRI: @sashi_kumar Backend backup DRI: @Andyschoenen
FE DRI: @arfedoro

This epic encompasses both Source branch pattern exceptions for MR Approva... (&18113 - closed) (Source branch pattern exceptions) and Service Account & Access Token Exceptions for M... (&18112 - closed) (Service Account & Access Token Exceptions) as a single deliverable for Exceptions and Bypasses in Merge Request Approval Policies. This requires extensive backend and frontend work, comprehensive testing, and enabling feature flags. This task carries the highest risk of missing delivery - we must communicate early if this work is slipping.

To start/continue working on

MR Approval Policies Warn Mode (&15552)

Target release: %18.5

BE DRI: @Andyschoenen Backend backup DRI: @bauerdominic
FE DRI: @aturinske

For MR Approval Policies Warn Mode, we should evaluate designs, agree on the scope, and discuss implications on Vulnerability Report functionality.

Say/Do

Check tasks you believe you can complete by the next milestone. If you identify any risks in delivery, please leave a comment in this planning issue or in the related Epic/Issue to highlight the risk. This will aid us in communicating any potential delays and improve our predictability. Thank you! 🙇

@arfedoro

@sashi_kumar

@mcavoj

@Andyschoenen

@bauerdominic

@aturinske

@mc_rocha

@imam_h

Risks and Mitigations

To help us proactively address potential challenges, we've identified key risks for this milestone and corresponding mitigation strategies:

1. High Volume of Committed Deliverables

Risk: Multiple complex epics committed for release in a single milestone may stretch team capacity and increase risk of incomplete delivery.

Mitigation:

  • Focus on early completion to allow time for issue resolution
  • Implement rigorous testing practices including dedicated bug bash day
  • Regular progress check-ins and early communication of any slipping items
  • Prioritize the highest-risk epic (Exceptions and Bypasses) for closest monitoring

2. Quality Assurance for Complex Features

Risk: New audit events and complex exception logic may introduce performance issues or unexpected behaviors.

Mitigation:

  • Dedicate one full day to organized bug bash activities
  • Encourage cross-team member testing and collaboration
  • Evaluate performance implications especially for audit events
  • Enable feature flags systematically with proper testing at each stage

3. Exceptions and Bypasses Epic Delivery Risk

Risk: This epic has been identified as having the highest risk of missing delivery due to extensive backend and frontend work required.

Mitigation:

  • Assign backup DRIs for critical path items
  • Implement early warning system - communicate immediately if work is slipping
  • Consider scope reduction if necessary to meet core commitments
  • Prioritize this epic's critical path items in sprint planning

Extra

Metrics

Release post items

Release post items related to current work in the format Epic | Release post | Milestone.

Epic Release post Milestone
&15869 (closed) [TBD] %18.2
&17392 (closed) [TBD] %18.2
&11919 (closed) [TBD] %18.2
&14090 [TBD] %18.2
Edited by 🤖 GitLab Bot 🤖