Updated hourlyHourly refreshSun, Oct 25, 2026
Finance · AI
AI agents are sending more and more code into review queues built for human-paced work. A coding assistant can speed up code writing, but it can’t show you whether review, security checks, and release approvals can keep pace with all that extra code. AI-native engineering — the practice of intentionally designing the engineering process so people and agents each do what they are best suited to — starts with identifying delivery bottlenecks, then deciding how much autonomy agents should have and how to maintain control as you scale.
The AI-Native Engineering Playbook, launching this week, helps teams turn faster coding into faster delivery by redesigning how they ship software with agents. Every practice in the playbook is grounded in insights from engineering leaders at GitLab, our customers, and members of our Software Engineering Leadership Forum (SELF) community. We also partnered with IT Revolution to incorporate findings from a diverse group of practitioners looking at AI-native software development from a number of different angles, from code review to agent autonomy.
Below are a few of the questions we sought to answer in the process of creating the playbook.
Where does the bottleneck go when coding gets faster?
Coding used to be the slowest, most expensive part of building software. Agents removed the bottleneck on coding, and the constraint moved to everything around the code: waiting for clarifications, environments, approvals, and other teams. GitLab’s AI Accountability Report, based on an April 2026 survey of 1,528 DevSecOps professionals, found that 79% of respondents agreed that individual developer productivity has improved with AI, but the overall software delivery process has not accelerated at the same pace.
Large enterprises typically have software delivery lead times of well over 200 days, with active development taking only 10% to 20% of that time. The numbers explain why a faster coding step is often disappointing in the long run. For example, imagine a 281-day delivery cycle that involves about 32 days spent on coding. Make coding 50% faster, and you save about 16 days, a 6% improvement. But if you take coding all the way to zero, around 88% of the lead time stays untouched. [1]
GitLab’s research similarly found that DevSecOps professionals reported spending only 16% of their time writing new code, and 85% agreed AI has shifted the bottleneck from writing code to reviewing and validating it.
That means your first job is diagnosis. Take one small, real change and trace it from request to production, marking every wait and every handoff. The longest waits show where your next improvement is, and it's rarely in the code. Watch where an agent stalls on a small task, too. The stall usually points to a standard nobody documented, an environment that’s hard to start, or context that lived in a single person’s head.
How much autonomy should agents have?
Agent autonomy should depend on how well you can verify the agent output. Imagine a ladder with four stages, ranging from semi-manual (a person approving every step) to fully autonomous (a zero-touch workflow). In this framework, there are clear rules for advancing up the ladder: no rungs can be skipped, and each step up needs to be backed with evidence from the rung below. [2]
Stage 1: Humans are in the loop at every step
Stage 2: Humans are still in the loop, but the agent executes within set bounds
Stage 3: Humans are out of the loop for normal operation and handle only exceptions
Stage 4: A zero-touch workflow, where the agent manages itself end to end, calling in a human only when predefined thresholds are met [2]
It’s also important for a named human to stay accountable for every AI-enabled workflow, and the line between a human reviewing and a human monitoring should be explicitly defined, since loose or arbitrary definitions tend to erode under time pressure. [3]
That erosion is the trap. A person who is nominally in the loop but approves everything gives the appearance of control without the benefits, and habit and volume can easily turn review into mindless rubber-stamping. A checkpoint nobody actually exercises is worse than none, because it creates confidence where the system needs scrutiny.
The way up is to earn each step on evidence. Set an explicit accuracy or success threshold before you widen a step, then move people from reviewing each step to monitoring the whole. An agent that stops more often to ask for help is a healthy sign, since the system is refusing to outrun its own evidence. [2]
How do you review code at agent volume?
Widening autonomy depends on catching mistakes, and that puts pressure on code review. Review at merge time was built for human-paced output. Agents raise the rate of change, and manual review of every change set has become unsustainable. GitLab’s research also highlighted this strain: 78% of respondents agreed existing code review processes were not designed for the scale of code AI tools enable, and 80% agreed their organization has adopted AI coding tools faster than it has developed policies to govern them.
The answer is a layered verification system in which each layer does the part it does best. Humans are only removed from the loop when the risk level and evidence justify that design choice — it’s never a default. [4]
Move objective checks, such as formatting, types, and dependency policy, as close to authoring as possible.
Keep changes small so every later layer works faster.
Define the expected behavior up front so there is something concrete to check.
Use an independent reviewer.
Match review depth to the risk of the change.
Record every agentic review decision in a form someone can inspect later.
The organizations that have been most successful here have already invested heavily in automated testing, static analysis, and small change sets, so the layers work best on a foundation you already have. [4]
Dive into the playbook, or contribute your own insights
Becoming AI-native is a practice that leaders will continue to refine with their teams as tools and understanding evolve. To get started, read the entire playbook, or begin with the part that matches where your team runs into the most friction:
Redesigning the work so agents fit the flow of delivery instead of attaching to steps built for people alone
Working with agents by deciding where human judgment and accountability stay and how engineers keep growing as the coding shifts
Governing and scaling from one workflow to many with the context, verification, and measurement that let you move faster without losing control of quality or risk
If you lead an engineering team and want to contribute your own insights to the playbook, join SELF, the community for engineering leaders navigating the AI era.
Papers cited in this article
Cochran, Timothy, and Bryan Finster, Tim Ottersburg, Scott Prugh, and Amy Willard. "When Coding Is Free, Where Is the Bottleneck? A Guide for Leaders Building Agent-Ready Delivery Systems." Enterprise Technology Leadership Journal 3, no. 2 (Fall 2026). https://itrevolution.com/product/when-coding-is-free/.
Cockcroft, Adrian, and Jeremy Eder, Joseph Enochs, Jenn Spykerman, and Brian Wald. "When Agents Decide: Continuous Decision Intelligence and the Substrate Beneath It." Enterprise Technology Leadership Journal 3, no. 2 (Fall 2026). https://itrevolution.com/product/when-agents-decide/.
Eslick, Ian, and Collin Fox, Amanda Graham, Suzette Johnson, Chuck Lafferty, Tom Kilcommons, Rosalind Radcliffe, Cat Swetel, Annie Vella, Sam Yeats, and Robin Yeman. "The Sociotechnical Architecture of AI-Enabled Enterprises: Principles, Patterns, and Practices for Human-Governed AI." Enterprise Technology Leadership Journal 3, no. 2 (Fall 2026). https://itrevolution.com/product/sociotechnical-architecture-of-ai-enabled-enterprises/.
Davis, Zach, and Michelle Gill, Elisabeth Hendrickson, Angie Jones, Sha Ma, Randy Shoup, and James Wickett. "Agentic AI and Code Reviews: Toward a Pattern Language for Code Reviews in the Age of Agentic AI." Enterprise Technology Leadership Journal 3, no. 2 (Fall 2026). https://itrevolution.com/product/agentic-ai-and-code-reviews/.
Oct 20 · 00:00·GitLab
AI · Semiconductors
The companies plan to combine their x86 CPU optimization work for PyTorch in oneDNN to give developers a common software path across AMD and Intel CPUs.
Oct 20 · 00:00·AMD
Sustainability · Software & IT
2026 reports for both Europe and the United States name Lenovo a Leader, citing its comprehensive approach to helping customers address IT costs and carbon emissions with Sustainability Solutions MORRISVILLE, N.C., October 19, 2026 – Lenovo today announced that it has been named a Leader in the IT Solutions quadrant of the 2026 ISG Provider Lens® Digital Sustainability reports for both Europe and the United States, c
Oct 19 · 13:00·Lenovo
Finance · AI
Infosys (NSE: INFY) (BSE: INFY) (NYSE: INFY), a global leader in AI-first business consulting and technology services, recently announced the...
Oct 19 · 10:32·Infosys
AI · Software & IT
The gap between finding a flaw and using it is closing In April 2026, Anthropic’s Claude Mythos found a bug in OpenBSD that had gone undetected since 1998, in one of the most heavily audited codebases in the world. In a few weeks it found thousands of previously unknown vulnerabilities across major operating systems and browsers, wrote working exploits, and chained them together with little human help. Anthropic judged the model as too dangerous to release but gave early access to a group of defenders through Project Glasswing. The lesson for enterprise IT leaders is simple. The work of fin...
Oct 19 · 05:00·Hewlett Packard Enterprise
SaaS · Gaming
Organizations running mission-critical workloads face a fundamental challenge: how to take advantage of Oracle Cloud Infrastructure's performance and economics without sacrificing the stability, security, and multicloud consistency that enterprise operations demand. Today, that challenge has a clear answer.Red Hat Enterprise Linux (RHEL) is now generally available as a native offering on the Oracle Cloud Infrastructure (OCI) Console, marking a significant milestone in the two-decade collaboration between Red Hat and Oracle.Hybrid cloud consistency built for seamless OCI migrationEnterprises ar
Oct 19 · 00:00·Red Hat
AI · SaaS
When code becomes abundant trust becomes scarce.
That is the argument GitLab CEO Bill Staples made in his recent essay: AI is collapsing the cost of producing software, and everything around production, including context, verification, governance, and evidence, becomes proportionally more important. Both security and collaboration are key elements to producing trust. AI widens what has to be trusted to include the agents that now write software along with the software that gets written.
That is why GitLab is joining the Open Secure AI Alliance, which brings together organizations to develop and share open technologies, techniques, and tools that help safeguard software and agents in the age of AI. We joined because we believe AI security is strongest when it can be inspected, tested, adapted, and improved by a broad community of defenders.
This is an extension of work GitLab is already doing in the open.
GitLab’s AI Gateway is a standalone service that provides access to AI features across GitLab.com, GitLab Dedicated, and self-managed instances. Its source code is public, and so are the agent workflow configurations running on AI Gateway, including configurations for code creation, code review, secrets false-positive detection, and security review.
Developer Flow configuration
Code Review Flow configuration
Security Review Flow
These examples reflect an important principle: An AI system is more than the model behind it. Trust depends on the surrounding harness, workflows, controls, context, and evaluation. Open tooling makes it easier for defenders to understand how those pieces work, test them against real risks, and improve them over time.
We also believe enterprises need choice. Organizations should be able to use proprietary and secure open weight models, select the right model for the job, and make decisions about where and how AI systems operate. Model and cloud agnosticism helps preserve that flexibility, while an open ecosystem gives customers more options for building, governing, and securing AI.
Transparency also has to cover the risks. Our documentation on security threats in agentic systems sets out the attack paths that apply to our own agents and the controls that apply in each environment. We treat our agents as privileged actors: Each one runs with an explicit identity, constrained tools and permissions, and actions that can be audited. We share how this works through our documentation for composite identity, sandboxed execution, per-flow tool restrictions, and agent tool governance.
Through our participation in the Open Secure AI Alliance, GitLab has an opportunity to share practical work already underway across our AI and security teams and learn from the broader community. Our goal is not to position open weight and closed models as opposites. It is to help ensure that defenders have the transparency, control, and flexibility they need to build trustworthy AI systems.
AI security should be built in the open. Learn more about the Open Secure AI Alliance.
Oct 19 · 00:00·GitLab
AI · SaaS
You already have an AI assistant. It completes your code, explains code you didn’t write, and maybe even drafts a whole feature while you sip your coffee. An agent on GitLab picks up where your editor stops.
The AI in your editor only knows what's open in your editor. It doesn't know that your merge request has been sitting in the queue for two days, or that your pipeline failed for the third time this week. Without your pipeline logs, it can’t offer a fix.
GitLab Duo Agent Platform works within the project and across your software delivery workflow, taking into account merge requests, issues, pipelines, and repositories your whole team shares. This context makes all the difference.
Here are three ways to try out GitLab’s agentic features today, and you don't need a paid GitLab plan to do it.
Set up your group
On GitLab.com, a group Owner sets up your top-level group:
Purchase GitLab Credits.
Go to Settings > Billing and select Purchase credits.
Turn on GitLab Duo Agent Platform.
Turn on foundational flows.
Go to Settings > GitLab Duo.
Select Change configuration.
Under Flow execution, select Allow flow execution and Allow foundational flows.
Select Code Review and Fix CI/CD Pipeline.
Select Save changes.
1. Hand off the first pass on reviews
Code Review Flow reads a merge request's diff, description, and related files (like tests and dependencies), then posts detailed review comments directly on the merge request. The flow catches small issues, missed edge cases, and inconsistent patterns on your merge requests, so you can save your judgment for the critical details.
Try it on your project:
On a merge request, assign @GitLabDuo as a reviewer, or comment /assign_reviewer @GitLabDuo.
Watch the review comments appear on the merge request itself, the same place your teammates will see them. Code Review Flow checks the diff, the description, and related files like tests and dependencies before it comments.
To hand off the first pass on every new merge request, turn on automatic reviews.
Watch how merge requests can speed up with Code Review Flow:
2. Send a failed pipeline to an agent to investigate
Have Fix CI/CD Pipeline Flow diagnose your failed pipeline and propose a fix, so you spend your time applying it instead of hunting for the cause.
This flow investigates logs, error messages, the merge request changes that likely caused it, and the repository contents. Depending on the failure, it either proposes an inline code suggestion on your merge request or opens a new merge request with a fix.
Try it on your project:
On a merge request with a failing pipeline, select Fix pipeline with Duo from the Overview or Pipelines tab. The flow reads the pipeline logs and your merge request changes to find the cause.
Select AI > Sessions to follow along, then review the result on your merge request. Depending on the failure, you get inline code suggestions you can apply, a new merge request if the fix touches files outside your diff, or a comment with next steps when a failure needs a person.
For pipelines that aren't tied to a merge request, you can trigger the same flow: go to Build > Pipelines, select the failing pipeline, and select Fix pipeline with Duo. You get a new merge request with the fix.
Follow along with this demo:
3. Get answers from across your project
Ask Agentic Chat what changed in a merge request or why last night's pipeline failed, and get one answer that pulls from your project's merge requests, issues, and pipelines. This is where most editor-based AI assistants fall short. Your IDE's assistant can tell you what a function does, but it can't tell you which issue introduced it or why last night's pipeline failed.
Try it on your project:
In the GitLab UI, open your project. In the GitLab Duo sidebar, select Add new chat, then select an agent. You can also use Agentic Chat in VS Code, JetBrains IDEs, and Visual Studio.
Make sure the Agentic toggle is turned on.
Ask what you'd normally dig for by hand. Agentic Chat searches your project's issues and merge requests by keyword and retrieves pipelines to build its answer. For ready-made prompts, browse the AI Resource Library, for example Summarize Recent Changes to MR/Issue or Debug Failing Pipeline.
You can also ask Agentic Chat to run either flow above on a merge request. Each chat message you send uses GitLab Credits.
Watch the demo:
What these agentic features cost
On GitLab Free, you can use a set of GitLab Duo Agent Platform agents and flows, including all three above, without upgrading to Premium or Ultimate. Your group buys a monthly commitment pool of GitLab Credits that every group member draws from, so you pay for the work agents and flows do instead of paying per seat. The pool refreshes each month on an annual term. You can increase it at any time and decrease it at renewal.
Each feature uses credits at its own rate. For Agentic Chat and Fix CI/CD Pipeline Flow, usage depends on the model and on how much back-and-forth a request needs. The credit multiplier tables list current rates. Buying the pool also turns on on-demand billing for usage beyond it, so set usage caps to control spend.
Where to start
If you only try one this week, make it the Code Review Flow. Assign @GitLabDuo as a reviewer on your next merge request and see what it comes up with. From there, Agentic Chat and Fix CI/CD Pipeline Flow are ready to be deployed when you are.
Ready to get started? You can purchase GitLab Credits for your monthly commitment pool in your Customer Portal.
Oct 19 · 00:00·GitLab
Industrial · Software & IT
Hyundai Motor and Kia to present vision for transition to software-defined factories (SDFs) at E-FOREST TECH DAY 2026 from Oct. 19–21
Around 200 new manufacturing technologies will be on display, including SDF and automation solutions
New manufacturing technology presentation conference and partner seminars to share new technology cases and future development strategies
Hyundai Motor and Kia aim to expand application of future manufacturing technologies across production sites while seeking new collaboration opportunities
Oct 18 · 00:00·Hyundai Motor Company
Software & IT
Appledore Research has released its《Leading Suppliers in OSS Software》report, in which Huawei's ADN solution claimed the top spot in market share for both overall OSS and domain management software.
Oct 16 · 09:41·Huawei
SaaS · Software & IT
Cloudflare Gateway and Data Loss Prevention have inherited the flexibility and power of Cloudflare Workers through our full-stack integration with the Cloudflare Developer platform.
Oct 15 · 17:11·Cloudflare
SaaS · Software & IT
Introducing Void: an open-source SDK, CLI, and self-hosted platform for building full-stack Vite apps and deploying them to Cloudflare.
Oct 15 · 14:00·Cloudflare