Today, there is no way for an instance or top-level group admin to fully disable Custom Agents and Custom Flows as a feature category. Customers with strict AI governance policies need a kill-switch for all custom AI functionality — independent of whether catalog access is restricted — so that only GitLab-managed foundational agents are available to their users. **Proposed Solution** * Add an TLG Owner-level toggle that disables Custom Agents and Custom Flows entirely. When disabled, no user regardless of role should be able to create, enable, or invoke custom agents or flows within the namespace. * Location of proposed toggle: [https://gitlab.com/groups/\[YOUR-GROUP-NAME\]/-/settings/gitlab_duo/configuration](https://gitlab.com/groups/gl-demo-ultimate-rkolosovskiy/-/settings/gitlab_duo/configuration) {width=900 height=535} **Acceptance Criteria** - An admin can disable custom agents, custom flows, and external agents at the instance level (Self-Managed) or top-level group level (GitLab.com). - When disabled, users cannot create, enable, disable, modify, or execute the respective items. - When disabled, existing items are no longer visible in the project under the Enabled tab. - When disabled, items created in the project still appear under the Managed tab, but cannot be modified or executed. - Foundational agents and flows remain available regardless of the setting. - The setting cascades to all subgroups in the group. - On Self-Managed, the instance-level setting cannot be overridden by group-level settings. - Setting changes are recorded in the audit logs.