Skip to content

Security Risk Management: Security Policies 18.4 Planning Issue

Previous planning issue: Security Risk Management: Security Policies 18.... (#549805 - closed)

18.4 Planning - groupsecurity policies

🎉 Thank You - %18.3 Milestone Deliveries

Fantastic work team on delivering our %18.3 commitments! We successfully completed:

  • Service Account & Access Token Exceptions for Merge Request Approval Policies (&18112 (closed)) - Providing administrators with granular bypass control
  • Security Policy Audit Events (&15869 (closed)) - Giving customers visibility into policy-related actions
  • Scan Execution Policy Templates (&11919 (closed)) - Enabling flexible trigger conditions for security scans
  • Pipeline Execution Policy Setting Control (#524124 (closed)) - Programmatic enable/disable capabilities

Thank you to everyone on the team for your dedication and collaborative effort in delivering these important security enhancements! 🎉

🎯 INTERLOCK COMMITMENTS - Our Primary Focus

Accountability Shift: We're focusing on Epic-level ownership rather than individual task tracking. DRIs are accountable for their Epic's success and will engage team members as needed to ensure delivery.

Epic: User and Group Exceptions in MR Approval Policies

Link: &18114
DRIs: @sashi_kumar (Backend) / @arfedoro (Frontend)

Goal: Deliver the feature within the milestone and enable by default, extending policy bypass capabilities to include user and group selection options.

Key Issues:

Success Criteria:

  • Feature flag enabled by default with comprehensive testing
  • Demo video documented in Epic showing complete functionality
  • Seamless integration with existing exceptions framework

Dependencies: None identified

Epic: MR Approval Policies Warn Mode

Link: &15552
DRIs: @Andyschoenen (Backend) (@mc_rocha as backup DRI in this milestone) / @aturinske (Frontend)

Goal: Collaborate with PM and UX to materialize the feature concept, develop backend PoC, and start frontend implementation behind feature flag. Establish clear delivery plan for %18.5 with scope clarification if needed.

Key Issues:

Success Criteria:

  • Working proof of concept demonstrating warn mode functionality
  • Clear implementation plan with started implementation for %18.5 delivery
  • Defined scope with stakeholder alignment on any limitations

Dependencies: UX designs are not fully completed yet

Team: @Andyschoenen + @mc_rocha + @imam_h (Backend) / @aturinske (Frontend)

Epic: Organization-Level Security Policy Management (Policies v2)

Link: &16664
DRI: @alan (interim), transitioning to @mcavoj when available

Goal: Collaborate with PM and UX to establish clear requirements for improved policy architecture and usability. Build lightweight PoC while coordinating with Security Platform Management team on potential integration with Secret Push Protection Configuration Profile.

Key Issues:

  • #549779 (closed) (Spike: Foundation Architecture Blueprint & PoC for Security Policies v2)

Success Criteria:

  • Completed spike with architecture blueprint and working PoC
  • Finalized designs and implementation issues for backend/frontend work
  • Epic split into milestone-sized deliverables with clear roadmap

Dependencies: Secret Push Protection Configuration Profile (&18524) depends on this feature

Team: @mcavoj/@alan + @bauerdominic + other team members (it will be effort for the whole team as we clarify the scope) (Backend) / @aturinske + @arfedoro (Frontend)

Epic: Technical Debt - Simplify YAML Syntax and Preview

Link: &15106
DRI: @arfedoro

Goal: Address user feedback by implementing identified improvements and clarifying future direction with PM for the advanced security policy editor.

Key Issues:

  • Implement Experimental Banners for Advanced Security Policy Editor

Success Criteria:

  • Delivered functionality enabled globally on GitLab.com
  • User feedback collection mechanism in place
  • Clear direction established for future iterations

Dependencies: None

Team: @arfedoro

📋 Additional Work - Supporting Our Goals

Critical Bug Fixes

  • #561292 (Dismissing vulnerability record not triggering webhook events)
  • #548967 (closed) (Compliance framework policy count incorrect)
  • #560859 (closed) (Group settings page breaks for large namespaces)

Future Milestone Preparation

  • Auto-dismiss irrelevant vulnerabilities (&10894) - Create implementation issues for Q4 interlocked item - @mc_rocha + @arfedoro
  • Add filter option for KEV in MR approval policies (&16311) - Prepare backend/frontend breakdown for Q4 delivery - @sashi_kumar + @aturinske

⚠️ Key Risks & Mitigations

Primary Risk: Incomplete Requirements and UX Designs

Impact: Could derail interlock commitments if scope remains unclear

Mitigation Plan:

  • Schedule immediate requirements clarification sessions with PM
  • Prioritize UX design completion for MR Approval Policies Warn Mode
  • Establish clear scope boundaries with stakeholder sign-off
  • Implement regular check-ins to surface requirement gaps early
  • Prepare scope reduction options if design completion delays occur

🚀 Next Steps

  1. DRIs: Review your Epic sections and confirm accountability for delivery
  2. Team: Engage with your assigned Epic DRIs for task coordination
  3. Requirements: Schedule immediate PM/UX alignment sessions for incomplete designs
  4. Communication: Use this issue for milestone progress updates and blockers

Issue assignments are based on expertise, capacity, and DRI responsibilities. Epic DRIs will ensure delivery through proper planning and team coordination focused on outcomes rather than task completion.

Say/Do

@imam_h

@mc_rocha

@aturinske

@alan

@sashi_kumar

@bauerdominic

@arfedoro

@Andyschoenen

Kanban Board: Security Policies Board
Group Priorities: Security Policies Direction

Edited by Alexander Turinske