Document subgroup selection in GitLab Duo access control

Pratyaksh Golashrequested to merge
628454-duo-access-control-subgroups-docs into master

What does this MR do?

Updates the access control page for the subgroup picker shipped behind the duo_admin_access_rules_subgroups feature flag in !255453 (merged). Follows the change list in the docs issue.

  • History entry under "Restrict access to GitLab Duo": subgroup selection introduced in GitLab 19.5 for GitLab Self-Managed and GitLab Dedicated with the feature flag, disabled by default. Version, offerings and default flag state live only here.
  • The standard [!flag] alert below that history block.
  • Self-Managed tab: the two "top-level groups only" sentences are replaced by "When you configure access controls, you can select a top-level group or a subgroup. If the feature flag is disabled, you can select only top-level groups." The "direct members" sentence is unchanged, since membership semantics did not change.
  • Self-Managed tab: one sentence that access changes can take up to 5 minutes because access decisions are cached per user. The cache is instance-level only, which is why the sentence sits in this tab and not in a shared section.
  • Phased rollouts example changed from pilot-users to engineering/duo-pilot.
  • GitLab.com tab unchanged.

Deviation from the issue. The issue says to remove the two limitation sentences. They are replaced instead: this MR merges before the feature flag is enabled by default, so on every instance the reader can still select only top-level groups, and the GitLab.com tab keeps its own "what you can select" paragraph. The flag-off sentence goes with the "Enabled" history entry later.

Question for the technical writer. The [!flag] alert sits below the section history, where the guide places it, but the flag affects only the Self-Managed tab. If you prefer the alert inside that tab, say so and I will move it.

Unlinkable facts. The feature issue, epic and rollout issue are confidential, so the history entry links the public feature MR.

Lint. markdownlint-cli2 at the pinned 0.23.2: 0 issues. Vale at suggestion level: 0 findings on the changed lines. Docs link check passed in the pre-push hooks.

Related issues

Resolves https://gitlab.com/gitlab-org/gitlab/-/issues/628454

Feature MR !255453 (merged) Epic https://gitlab.com/groups/gitlab-org/-/epics/23483

Author's checklist

If you are a GitLab team member and only adding documentation, do not add any of the following labels:

  • ~"frontend"
  • ~"backend"
  • ~"type::bug"
  • ~"database"

These labels cause the MR to be added to code verification QA issues.

Reviewer's checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

If you aren't sure which tech writer to ask, use roulette or ask in the #docs Slack channel.

  • If the content requires it, ensure the information is reviewed by a subject matter expert.

  • Technical writer review items:

    • Ensure docs metadata is present and up-to-date.
    • Ensure the appropriate labels are added to this MR.
    • Ensure a release milestone is set.
    • If relevant to this MR, ensure content topic type principles are in use, including:
      • The headings should be something you'd do a Google search for. Instead of Default behavior, say something like Default behavior when you close an issue.
      • The headings (other than the page title) should be active. Instead of Configuring GDK, say something like Configure GDK.
      • Any task steps should be written as a numbered list.
      • If the content still needs to be edited for topic types, you can create a follow-up issue with the docs-technical-debt label.

  • Review by assigned maintainer, who can always request/require the reviews above. Maintainer's review can occur before or after a technical writer review.

Merge request reports