Add cascading ai_governance_enabled setting

What does this MR do and why?

Why

AI Governance features are currently gated behind Duo Agent Platform (DAP) being enabled. Governance does not require DAP, because third-party integrations exist.

This MR adds an opt-in umbrella setting, ai_governance_enabled (default false). It is meant to replace DAP as the gate and to simplify monetization.

What

ai_governance_enabled is a cascading boolean: the instance sets the default, groups and subgroups can override it, and projects can override their group. Admins can lock it at the instance level, and group owners can lock it at the group level, so everything below inherits the locked value. It is modeled on ai_audit_events_storage_enabled, the sub-setting that sits under it.

• Columns added:
  • application_settings.ai_governance_enabled and application_settings.lock_ai_governance_enabled
  • namespace_settings.ai_governance_enabled and namespace_settings.lock_ai_governance_enabled
  • project_settings.ai_governance_enabled
• Models: added to the cascading_attr lists on NamespaceSetting and ProjectSetting, delegated from Namespace and Project, and accepted as a namespace setting param (group owners only).
• Cascade on write: a change on the instance or a group is written to all descendants by the existing cascade workers (ApplicationSettings::UpdateService, Groups::UpdateService, Ai::CascadeDuoSettingsService). New projects copy the group value at creation (DUO_CASCADING_SETTINGS in Projects::CreateService). New subgroups need no change: their namespace_settings value is NULL, so they read the parent value.
• Audit event: ai_governance_enabled_updated is recorded when the setting changes on a group or project.

The setting reuses the generic cascade services, but it is deliberately not part of Duo settings. It is not added to the Duo settings attributes, the Duo settings GraphQL types, or the Duo settings UI.

Not in this MR

• Any REST or GraphQL API exposure. The application setting has no api_type.
• UI.
• Policy or feature gating. Nothing reads the setting yet.
• Backfill for existing customers.

References

• This task: https://gitlab.com/gitlab-org/gitlab/-/work_items/632724
• Settings UI: https://gitlab.com/gitlab-org/gitlab/-/work_items/632551
• Backfill: https://gitlab.com/gitlab-org/gitlab/-/work_items/633222
• Related: !261994

How to set up and validate locally

1. Run bin/rails db:migrate.

2. In the Rails console, check the defaults:

   ApplicationSetting.new.ai_governance_enabled # => false
   Group.first.ai_governance_enabled # => false

3. Turn it on for a group that has a subgroup and a project, then let Sidekiq run Namespaces::CascadeDuoSettingsWorker:

   group = Group.find_by_full_path('my-group')
   owner = group.owners.first
   Groups::UpdateService.new(group, owner, ai_governance_enabled: true).execute
   # After the worker runs:
   group.descendants.first.reload.ai_governance_enabled # => true
   group.all_projects.first.reload.ai_governance_enabled # => true

4. Lock it at the instance level and confirm a group can no longer override it:

   ApplicationSetting.current.update!(ai_governance_enabled: true, lock_ai_governance_enabled: true)
   settings = Group.first.namespace_settings
   settings.update(ai_governance_enabled: false) # => false
   settings.errors[:ai_governance_enabled] # => ["cannot be changed because it is locked by an ancestor"]

Database review

• Two migrations, Migration[2.4], milestone 19.6:
  • AddAiGovernanceEnabledCascadingSetting uses add_cascading_namespace_setting. It adds four columns: two on application_settings and two on namespace_settings.
  • AddAiGovernanceEnabledToProjectSettings adds one column on project_settings.
• All columns are boolean with a constant default, and null: false where applicable. namespace_settings.ai_governance_enabled is nullable, as the helper always creates it, so subgroups can inherit. A constant default is metadata-only on PostgreSQL 11 and later, so there is no table rewrite.
• No new indexes.
• Precedent: the ai_audit_events_storage_enabled migrations 20260624201545 and 20260624201546.

Rollback

Run bin/rails db:rollback STEP=2. The cascading migration's down calls remove_cascading_namespace_setting, and the project settings migration is reversible. Nothing reads the setting yet, so no data needs to be recovered.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.