## What this is Custom organizations on GitLab.com cannot have their own integration defaults today. The database is organization-aware. The application code is not. This epic makes the instance-level integration defaults work per organization. ## What is already fine - `integrations`, `issue_tracker_data`, `jira_tracker_data` and `zentao_tracker_data` use the `gitlab_main_org` schema. They have `project_id`, `group_id` and `organization_id` sharding keys. A CHECK requires that exactly one is set. See [`integrations.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/db/docs/integrations.yml). - Group and project integrations are already scoped by `group_id` and `project_id`. Only instance-level defaults are the problem. - The organization admin area exists at `/o/:organization_path/admin` ([#587370](https://gitlab.com/gitlab-org/gitlab/-/work_items/587370), closed in 19.4). Its Settings menu has only "General". ## What is broken - Lookups and validation ignore the organization. `instance_level_integration`, `instance_exists_for?`, `default_integrations`, `for_instance` and `find_or_initialize_non_project_specific_integration` never filter by `organization_id`. The uniqueness validation allows one instance-level integration per type in the whole cell. See [`base/integration.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/models/concerns/integrations/base/integration.rb). - Propagation touches every project and group in the cell. See [`propagate_service.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/services/integrations/propagate_service.rb) and the six propagation workers, for example [`propagate_integration_worker.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/workers/propagate_integration_worker.rb). - The admin UI is hidden on GitLab.com because `instance_level_integrations?` returns `!Gitlab.com?`. See [`integrations_helper.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/helpers/integrations_helper.rb). - Nine places read the first instance-level row and assume one organization, for example [`beyond_identity.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/models/integrations/beyond_identity.rb). - The frontend has no organization level. `integrationLevels` has only PROJECT, GROUP and INSTANCE. See [`constants.js`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/assets/javascripts/integrations/constants.js). ## Work items The table is sorted by priority. P1 unblocks everything else and includes the database change. P2 is independent backend and frontend work. P3 needs P1 and the design decision first. Backend and frontend are kept in separate issues. Issues carry `priority::1` to `priority::3` labels. | # | Priority | Area | Issue | Milestone | Depends on | |---|---|---|---|---|---| | 01 | P1 | Database | [Add unique index for org integration defaults #631286](https://gitlab.com/gitlab-org/gitlab/-/work_items/631286) | Completed in %19.5 | None | | 02 | P1 | Backend | [Scope instance integration lookups to organization #631287](https://gitlab.com/gitlab-org/gitlab/-/work_items/631287) | Completed in %19.5 | None | | 03 | P1 | Backend | [Scope integration propagation to organization #631288](https://gitlab.com/gitlab-org/gitlab/-/work_items/631288) | Completed in %19.5 | None | | 04 | P1 | UX | [Design integrations in org admin area #631297](https://gitlab.com/gitlab-org/gitlab/-/work_items/631297) | %19.6 | None | | 05 | P2 | Backend | [Add org owner permission to manage integrations #631290](https://gitlab.com/gitlab-org/gitlab/-/work_items/631290) | Completed in %19.5 | None | | 06 | P2 | Backend | [Fix single-org instance integration callers #631289](https://gitlab.com/gitlab-org/gitlab/-/work_items/631289) | | ~~[#631287](https://gitlab.com/gitlab-org/gitlab/-/work_items/631287)~~ | | 07 | P2 | Frontend | [Add organization level to integrations form #631294](https://gitlab.com/gitlab-org/gitlab/-/work_items/631294) | %19.6 | None | | 08 | P2 | Backend | [Add cross-organization specs for integrations #631293](https://gitlab.com/gitlab-org/gitlab/-/work_items/631293) | Completed in %19.5 | ~~[#631287](https://gitlab.com/gitlab-org/gitlab/-/work_items/631287)~~, ~~[#631288](https://gitlab.com/gitlab-org/gitlab/-/work_items/631288)~~ | | 09 | P3 | Backend | [Serve integrations pages in org admin area #631291](https://gitlab.com/gitlab-org/gitlab/-/work_items/631291) | | ~~[#631287](https://gitlab.com/gitlab-org/gitlab/-/work_items/631287)~~, ~~[#631290](https://gitlab.com/gitlab-org/gitlab/-/work_items/631290)~~, [#631297](https://gitlab.com/gitlab-org/gitlab/-/work_items/631297) | | 10 | P3 | Frontend | [Mount integrations pages in org admin area #631295](https://gitlab.com/gitlab-org/gitlab/-/work_items/631295) | | [#631291](https://gitlab.com/gitlab-org/gitlab/-/work_items/631291), [#631294](https://gitlab.com/gitlab-org/gitlab/-/work_items/631294), [#631297](https://gitlab.com/gitlab-org/gitlab/-/work_items/631297) | | 11 | P3 | Backend | [Log organization_id in integration workers and services #631292](https://gitlab.com/gitlab-org/gitlab/-/work_items/631292) | %19.5 | None | | 12 | P3 | Documentation | [Document organization-level integration defaults #631296](https://gitlab.com/gitlab-org/gitlab/-/work_items/631296) | | [#631291](https://gitlab.com/gitlab-org/gitlab/-/work_items/631291), [#631295](https://gitlab.com/gitlab-org/gitlab/-/work_items/631295) | | 13 | P3 | Database | [Drop redundant integrations instance index #631838](https://gitlab.com/gitlab-org/gitlab/-/work_items/631838) | | ~~[#631287](https://gitlab.com/gitlab-org/gitlab/-/work_items/631287)~~, [#631289](https://gitlab.com/gitlab-org/gitlab/-/work_items/631289) | | 14 | Triage | Backend | [Apply the #591182 each_batch fix to instance-level integration propagation #631695](https://gitlab.com/gitlab-org/gitlab/-/work_items/631695) | | None | ## Out of scope - System hooks. They are tracked separately. - Per-integration Cells routing, such as Jira Connect and the Slack app. Plan groups own these. - An organization-level REST API, until product decides. - Data migration for the default organization. ## Open questions | Question | Who to ask | Why it matters | |----------|------------|----------------| | Do instance-only integrations (`beyond_identity`, `amazon_q`) become organization-level? | Jennifer Black and the owning groups per the cross-stage features handbook page | Changes the `INSTANCE_LEVEL_ONLY_INTEGRATION_NAMES` list and #631289. | | Does the `allowed_integrations` allowlist (an instance application setting) become an organization setting? | Jennifer Black | Would add a database column and a new work item. | | Who owns the GitLab for Slack app instance install (`Admin::SlacksController`) for this change? | Alexandru Croitor (group::work items) | It is one of the single-org callers in #631289. | | System hooks: same epic later or a separate one? | Thiago Figueiro | Delivery is still cell-wide (`SystemHooksService`). It is a different feature. | ## History This replaces the July 2026 description. That description came from the [spike](https://gitlab.com/gitlab-org/gitlab/-/work_items/598315). Re-checked against the code on 2026-09-29. ## Links - Self-assessment: https://gitlab.com/gitlab-com/gl-infra/tenant-scale/organizations/organizations-feature-parity/-/work_items/14 - Spike: https://gitlab.com/gitlab-org/gitlab/-/work_items/598315 - Ownership issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/599597 - Org admin area: https://gitlab.com/gitlab-org/gitlab/-/work_items/587370 - Jira Connect on Cells: https://gitlab.com/gitlab-org/gitlab/-/work_items/591784 - Slack app on Cells: https://gitlab.com/gitlab-org/gitlab/-/work_items/467791 - Cells commitment register: https://gitlab.com/gitlab-com/gl-infra/tenant-scale/cells-infrastructure/team/-/work_items/787 - Current docs: https://docs.gitlab.com/administration/settings/project_integration_management/