GitLab's public handbook splits AI rules by team, not one policy

The setup

GitLab publishes nearly its entire company handbook at handbook.gitlab.com, a rare case of a real company's internal operating rules sitting in public view. Checked on 16 September 2026, the page a central AI security policy would be expected to occupy, handbook.gitlab.com/handbook/security/ai-guidelines/, returns a sign-in redirect rather than a public page — that path currently sits behind GitLab's internal authentication, not the open handbook. What is public instead is a set of team-level pages, each written by the team that owns the risk it covers.

What the documents show

Two of those pages set out concrete, narrower rules. The Support team's AI Usage Recommendations, last modified 23 April 2026, tells support engineers which data an LLM may even see, using GitLab's own classification labels: 'ZenDesk data is ORANGE, but attachments are RED. Not all LLM tools are cleared for RED data.' Separately, Engineering's Infrastructure Platforms group publishes AI Usage Principles, last modified 16 April 2026, stating that 'using AI to help frame or structure a response is fine. The end result should still be yours,' and that for production risk, 'if you haven't verified it, don't merge it.'

The friction

There is no single page: each document records one team's decision, not a company-wide rule, so a reader has to know which team wrote the page in front of them. The Support page names a real limitation in the tooling itself — not every LLM product the team might want to use is cleared to see its most sensitive data, which rules out some tools for some tasks by policy rather than by capability. The Infrastructure Platforms page's own edit history shows a commit to 'soften language on AI usage principles,' evidence that even a public, low-stakes internal page gets renegotiated after it ships.

What changed in the work

What these pages document, in GitLab's own words, is differentiated rather than blanket treatment: scrutiny is matched to impact — 'infrastructure configuration...need the same rigorous review regardless of how they were produced. Plausible is not the same as correct' — while low-risk internal tooling gets a lighter touch. Support staff are told to disclose AI-assisted summarizing to the people receiving it, not to pass it off as their own unaided reading. This is one company's documented decision, current as of April 2026 by the pages' own edit dates, not an industry standard to generalize from.

• Does your own company have one AI policy, or several team-level pages that quietly disagree?
• Which of your vendor's tools are actually cleared for your most sensitive data category, in writing?
• Who signs off when AI-generated work touches something with on-call or compliance consequences?

A public handbook does not make a policy universal; it makes one company's working answer checkable. GitLab's pages show a team-by-team approach still being revised line by line, which is a more candid picture of how a real organization sets AI rules than a single polished policy page would have been.