glab govern

Configure and operate GitLab's experimental AI agent governance support for external agents.

Safety and scope

• Governance sync is an external data upload, not just local diagnostic logging. Uploaded events can include user prompts, tool-call arguments (commands, file paths, edits; replaced with a marker over 8 KB), outcomes/errors/durations, model, and token usage. Tool output and response text are not uploaded. Do not assume this excludes secrets in prompts or arguments.
• glab govern setup installs Claude Code Stop and SessionEnd hooks in ~/.claude/settings.json and, by default, a durable fallback periodic sync job on macOS/Linux. Obtain approval for both the settings change and transcript upload scope before running setup.
• Use --no-fallback-sync to install hooks without installing or replacing the fallback job. It does not remove an existing job or clear stored agents; verify those separately before treating the machine as hooks-only. The hooks still upload audit events. This is not a no-upload mode.
• --agents codex,cursor enables transcript discovery without agent hooks, including sessions from before enablement, for repositories on GitLab hosts you are logged in to. Enabling these agents needs explicit approval for historical uploads and all eligible repositories, not just the current checkout.
• This integration does not automatically govern Hermes. OpenCode hook-recorded sessions are supported and read through opencode export; setup's installed hooks are for Claude Code.
• Prefer glab govern doctor for read-only diagnosis. This refresh's help verification does not authorize running setup, sync, uninstall, or changing host services.

Setup and verification