NextLabs Announces Enforcer for GitLab to Extend Zero Trust Security Across the Software Development Lifecycle

NextLabs extends centralized, attribute-based security to GitLab repositories and CI/CD pipelines to protect source code and secure software supply chains.

SAN MATEO, CA, UNITED STATES, November 11, 2026 /EINPresswire.com/ -- NextLabs, a leader in Zero Trust data security and dynamic authorization solutions, today announced the availability of NextLabs Enforcer for GitLab, extending attribute-based, Zero Trust policy enforcement to GitLab repositories and DevSecOps pipelines. The solution enables organizations to centrally manage and dynamically enforce security policies governing source code changes, merge requests, pipeline execution, and other sensitive development activities.

NextLabs Enforcer for GitLab has been included in the most recent version of the implementation practices guide of the National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE) Secure Software Development, Security, and Operations (DevSecOps) Practices project. NextLab GitLab Enforcer, alongside NextLabs CloudAz Zero Trust Policy Platform as well as its SkyDRM and Windows Enforcer products, provides centralized, policy-based authorization and fine-grained enforcement for applications and data across enterprise environments.

Source code represents some of an organization's most valuable intellectual property, while CI/CD pipelines have become increasingly important targets for attackers seeking to compromise software development environments. As development teams collaborate across business units, contractors, offshore partners, and automated service accounts, organizations need more granular controls to ensure that only authorized users, trusted automation, and compliant environments can access sensitive code or advanced software through the development lifecycle.

Traditional repository permissions and project-scoped roles cannot account for the full context of an access request, including user attributes, project and branch sensitivity, device security, environmental conditions, and compliance requirements. Organizations often compensate by embedding security rules into individual pipeline configurations, creating administrative complexity and inconsistent enforcement.
NextLabs Enforcer for GitLab addresses these challenges by externalizing authorization and applying centralized, attribute-based policies at the point of access and execution. Acting as a Policy Enforcement Point (PEP), the solution evaluates sensitive GitLab activities against policies managed in NextLabs CloudAz, enabling organizations to enforce security requirements dynamically without maintaining separate rules across individual projects and pipelines.

"Software development environments have become critical repositories of intellectual property, and organizations need to extend Zero Trust security beyond traditional application access to the code, development processes, and automation that produce their software," said Keng Lim, CEO of NextLabs. "Enforcer for GitLab brings our centralized, attribute-based authorization approach into the DevSecOps lifecycle, helping organizations protect sensitive source code, enforce secure development policies, and maintain consistent control over how software is developed and released."

NextLabs Enforcer for GitLab

NextLabs Enforcer for GitLab integrates with GitLab to provide centralized, policy-driven authorization for repository and CI/CD activities. The solution gathers real-time context about the user or service account, project, branch, pipeline, and classification involved in a request, and evaluates that context against policies managed by the NextLabs CloudAz Policy Engine.

The solution supports authorization for code pushes, merge requests, and pipeline execution, allowing organizations to apply different controls based on the sensitivity of the source code, the user's organizational role and project assignment, and the security posture of the environment.

With centralized policy management, organizations can define and enforce security requirements across projects, groups, and pipelines while allowing development teams to continue working within GitLab. Policies automatically adapt to changes in user, project, and environmental attributes, enabling security controls to evolve dynamically with changing business responsibilities and development requirements.

Key Capabilities of NextLabs Enforcer for GitLab Include:

Attribute-Based Access Control (ABAC): Evaluate authorization requests using attributes describing users, service accounts, projects, branches, compliance frameworks, network locations, device risk, and other business and environmental context. Policies dynamically reflect current attribute values from enterprise identity providers, GitLab, and attribute provider plugins.

Project-Based Pipeline Authorization: Restrict pipeline execution on sensitive projects to users who are assigned to the project, hold an authorized role, and meet the required access level. Enforcement uses GitLab compliance frameworks and pipeline execution policies to introduce policy checkpoints into pipelines.

Sensitive Branch Protection: Assign sensitivity levels to branches and evaluate push requests against centralized policies. Pre-receive server hooks can reject unauthorized pushes to protected branches, preventing users with insufficient authorization from introducing changes to sensitive code.

Cross-Sensitivity-Based Merge Protection: Evaluate merge requests before allowing changes into protected branches. Policies can prevent lower-sensitivity code from being merged into higher-sensitivity branches, require authorization for the target branch, and enforce reviewer requirements.

Non-Human Identity Governance: Apply distinct policies to service accounts, bots, and scheduled pipelines. Automated identities can be restricted by project, permitted action, and branch sensitivity rather than inheriting permissions intended for human developers.

Pipeline Compliance Checks: Introduce policy checkpoints into build, test, and deployment activities to evaluate whether development processes meet security and compliance requirements. Enforcement can be tailored to pipeline requirements and project sensitivity.

Code-Free Centralized Policy Management: Author, test, and deploy policies centrally through NextLabs CloudAz Control Center. Security administrators can update authorization rules across integrated projects without modifying individual GitLab configurations or pipeline files.

Centralized Audit and Incident Management: Record authorization requests and decisions centrally, including the policy applied and the context of the action and resource. Policy violations can generate incident notifications with information needed to investigate and remediate security events.

Extend Zero Trust Across the Software Supply Chain

NextLabs Enforcer for GitLab enables organizations to extend Zero Trust principles into the software development lifecycle by applying consistent authorization policies to source code, development activities, and CI/CD execution.
Organizations can enforce internal secure-development requirements and external frameworks, including the NIST Secure Software Development Framework (SSDF), while maintaining centralized visibility into authorization decisions and policy violations.

The solution also supports a broader approach to protecting development environments by extending the same CloudAz policies to developer workstations and CI/CD runner hosts.

With NextLabs Windows Desktop Enforcer and SkyDRM, organizations can protect source code on developer workstations through secure sanctuary folders that restrict access to authorized users, trusted applications, and compliant devices. Codes moved outside the protected environment can be automatically encrypted to help prevent unauthorized use.

On GitLab runner hosts, policies can govern job execution, enforce endpoint security requirements, and encrypt build artifacts. Risk-based controls can further restrict access when device security posture declines.

Extending centralized authorization to developer endpoints and runner environments ensures consistent security across the development process, beyond repository permissions and pipeline configurations.

Tony Berning
NextLabs
+1 650-577-9101
Visit us on social media:
LinkedIn
YouTube
X