### User problem to solve As a top-level group owner, I want Duo CLI off for my namespace until it's been reviewed and approved, so that it isn't available to my developers before we've cleared it through security and procurement. ### Proposal Add a binary setting in `admin/gitlab_duo/configuration` {width="518" height="600"} #### **Default behavior** * The setting defaults to ~~`off`~~ `on` for all instances, including those where Duo CLI was previously used in beta. We'll treat the beta to GA boundary as a clean break rather than a per-instance migration. #### State logic Duo CLI is available only when all of the following are true. | Duo availability | Agent Platform | CLI toggle | Duo CLI result | |------------------|----------------|------------|----------------| | Always off | any | any | unavailable | | Off by default | any | any | unavailable | | On | Off | any | unavailable | | On | On | any | Unavailable | | On | On | Off | Unavailable | | On | On | On | Available | #### Acceptance Criteria * setting is visible on the admin configuration page, above Agents section * setting defaulted to ~~off~~ on * when the setting is off, Duo CLI requests return an error directing the user to contact their admin * when any parent setting is off (see table above), the CLI toggle is disabled in the UI * beta users transitioning with us to GA land in the off state and see the admin-contact error until an admin enables the setting * Duo CLI docs callout that admin enablement is required, with a link to admin configuration page #### What we need to figure out * Error message copy shown to users when Duo CLI has not been enabled by admin