[FF] composite_identity_audit_event_attribution -- attribute audit events to service account with human author

Summary

Roll out the feature currently behind the composite_identity_audit_event_attribution feature flag.

  • DRI: @vpedak1
  • Team Slack channel: #sec-comply-govern-control-team

Note

Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. Feature flag controls · Feature flag lifecycle

What could go wrong?

The gated code runs in Gitlab::Audit::Auditor#initialize, which every audit event write passes through. A defect would surface as failed or misattributed audit writes across the instance; disabling the flag stops the new code from executing entirely. While the flag is partially enabled, the audit log has mixed attribution semantics for composite identity actions (some events attributed to the human, some to the service account with human_author_* details), so prefer a short rollout window. Watch the dashboards in the Monitoring section below.

The flag actor is the scope's root namespace (:instance for user-scoped and instance-scoped events), so per-actor enablement covers whole group hierarchies; user-scoped and instance-scoped audit events only change behavior at full enablement.

Monitoring

Check these after every rollout step, and keep watching for at least 15 minutes after each production change:

  • Compliance group dashboard — Rails and Sidekiq error ratios and Apdex for the group's feature categories (audit_events, compliance_management). Feature flag changes appear as annotations, so regressions line up with the step that caused them.
  • Sidekiq worker detail: audit streaming workers — execution and error rates for AuditEvents::AuditEventStreamingWorker and AuditEvents::AiAuditEventStreamingWorker, the async audit path.
  • General platform triage — overall Apdex and error ratios for web, api, and sidekiq. The gated code is on the path of every audit write, so a defect can show up outside the group's own feature categories.

If error ratios rise or Apdex drops after a step, roll back first, investigate second.

Rollout

Run all production /chatops in #production and cross-post the results to #sec-comply-govern-control-team. Background: incremental rollout process, feature actors.

Non-production

  • Enable for 50% of actors on non-production environments:

    /chatops gitlab run feature set composite_identity_audit_event_attribution 50 --actors --dev --pre --staging --staging-ref

  • Fully enable on non-production environments:

    /chatops gitlab run feature set composite_identity_audit_event_attribution true --dev --pre --staging --staging-ref

  • Verify on staging: a composite identity action (for example a Duo agent flow) produces an audit event attributed to the service account with human_author_* details.

Production — one step at a time; wait at least 15 minutes between steps and check the Monitoring dashboards before moving to the next one:

  • Enable for gitlab-org and gitlab-com: ( enabled 6 Aug 12:38 BST )

    /chatops gitlab run feature set --group=gitlab-org,gitlab-com composite_identity_audit_event_attribution true

  • Enable for 1% of actors: ( enabled 12:48 )

    /chatops gitlab run feature set composite_identity_audit_event_attribution 1 --actors

  • Enable for 5% of actors: ( enabled 13:08 )

    /chatops gitlab run feature set composite_identity_audit_event_attribution 5 --actors

  • Enable for 10% of actors:

    /chatops gitlab run feature set composite_identity_audit_event_attribution 10 --actors

  • Enable for 25% of actors: ( 14:03 - observing sidekiq SLO violation alert but it seems a general infrastructure issue, unrelated to the current changes )

    /chatops gitlab run feature set composite_identity_audit_event_attribution 25 --actors

  • Enable for 50% of actors:

    /chatops gitlab run feature set composite_identity_audit_event_attribution 50 --actors

  • Enable for 100% of actors:

    /chatops gitlab run feature set composite_identity_audit_event_attribution 100 --actors

  • Complete the Before global rollout checklist below.

  • Enable globally (also covers user-scoped and instance-scoped audit events):

    /chatops gitlab run feature set composite_identity_audit_event_attribution true

Before global rollout

Confirm the relevant gotchas before going to 100% — see enabling a feature for GitLab.com:

Cleanup

Remove the flag once deemed stable — see cleaning up.

  • Open an MR removing the flag and its YAML definition from the codebase, or a follow-up Feature Flag Cleanup issue

  • After the cleanup MR merges, confirm it reached production:

    /chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/240418 19.3

  • Delete the flag from all environments:

    /chatops gitlab run feature delete composite_identity_audit_event_attribution --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set composite_identity_audit_event_attribution false                                         # production














/chatops gitlab run feature set composite_identity_audit_event_attribution false --dev --pre --staging --staging-ref     # non-production














/chatops gitlab run feature delete composite_identity_audit_event_attribution --dev --pre --staging --staging-ref --production  # remove entirely
Edited by Vasyl Pedak