Unblock agentic software delivery with governed code review

AI agents have changed how much code a team can produce in a day. Review queues haven’t kept up, and delivery stalls while changes wait for a closer look. The usual workarounds (reminders, reviewer rotations, assigning a team) buy a little time and then burn people out.

Client-side review with AI helps the author by catching issues as the code is being written, before a merge request even opens. But it only goes so far. A review that only checks quality still leaves the organization without enforceable policy on the way to production, since comments on a diff do not decide whether a change can merge or reach production.

Every merge request still needs a consistent certification step tied to pipelines, security findings, code owners, approval rules, and audits. Review in the author’s environment cannot standardize that work across all your projects, route policy-bound changes to the right person, or show leaders what the agent did before the change merges. As agents write more of the code, automated reviews need to happen in the platform that already tracks each change from plan to production, and where identity, policy, and oversight controls are already in place.

Earlier this year, we made Code Review Flow generally available on GitLab Duo Agent Platform, bringing that sign-off to the merge request and making agentic review part of the same platform where code ships. Teams can turn it on so every change is automatically addressed under rules you set once, at $0.25 per review, delivering an estimated 100x ROI. That predictable unit cost is low enough to leave automatic review on for every merge request, which is how reviews move at machine speed while staying cost-efficient at organizational scale.

Agentic reviews, built for how you ship

Code Review Flow is native to GitLab merge requests, so it covers your whole environment. It runs as a CI/CD job on your runners, whether GitLab-hosted or your own, so review executes in the same environment as the rest of delivery. It works the same way on GitLab.com, GitLab Dedicated, and GitLab Self-Managed, keeping inference under your control with self-hosted models when air-gapped or regulated environments require it. You also have the flexibility to choose which model acts as the foundation for agentic code review: GitLab-managed or your own self-hosted models.

When certification is the default on the merge request, teams get coverage, control, and follow-through in one place. Here are the key highlights for agentic code review with GitLab Duo Agent Platform:

Every merge request is reviewed, without anyone having to ask. Turn on automatic reviews at the project, group, or instance level and settings cascade. Authors don’t have to remember to request a first pass.

Standards you set once for how the group ships. Custom review instructions capture language conventions, security practices, and path-specific rules. A group can point the Code Review Flow at a template project so those standards travel with the work. Pair guidance with GitLab’s enforced security and compliance controls when a requirement must always hold.

Review summary with agent session

Follow-through on every finding. Follow-up review rechecks what GitLab Duo Agent Platform already flagged, verifies fixes, and avoids repeating the same points. At that price, you can leave automatic reviews everywhere.

The right human, when policy requires one. Code owners and relevant approval rules still apply. Recommend Reviewers Flow suggests the smallest group that can satisfy those rules based on their level of expertise, workload, availability, and timezone.

How agentic code review works in GitLab

Within GitLab, code review happens on the merge request, next to your pipelines, security findings, and approvals.

• A merge request opens (or becomes ready). Automatic review can start the Code Review Flow, or an author assigns GitLab Duo.
• The flow runs as a CI/CD job on your runners, analyzes the change with repository and merge request context, guided by your custom review instructions and the models your group selected, and comments on the diff.
• Authors and their coding agents push fixes. Follow-up review verifies Duo’s prior findings and carries context forward from the earlier pass.
• When a human must approve, Recommend Reviewers Flow proposes who should take the request; you assign from the merge request.
• Pipelines, security findings, approval rules, and the session record stay in the same place, so “reviewed” means certified on the path to production.

What’s ahead

Our platform roadmap for agentic code review includes:

Deeper review when the change warrants it. An extended analysis pass will pull in calling code and tests for high-complexity merge requests, under your model-selection controls.

Clearer decisions on the merge request. GitLab Duo will be able to approve or request changes under settings you control.

Focus on risk. Risk assessment on the merge request will help teams see which changes deserve more attention.

Review before the merge request opens. Local review in Duo CLI will let developers run project review guidance against working-tree changes before the merge request runs the organization’s official check.

As agents write more of your code, you need reviewed code reaching production, with every change held to your standards and your reviewers focused on the changes that need a person. Every improvement on this roadmap is built to help you get there.

Getting started

If you are new to GitLab Duo Agent Platform, you can get access with a free trial. If you already are a GitLab Premium or Ultimate customer, you can simply turn on Duo Agent Platform and use the GitLab Credits included with your subscription.

This blog post contains "forward‑looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934. Although we believe that the expectations reflected in these statements are reasonable, they are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to differ materially. Further information on these risks and other factors is included under the caption "Risk Factors" in our filings with the SEC. We do not undertake any obligation to update or revise these statements after the date of this blog post, except as required by law.