AILANG · sketch
§1 · AI-readiness
The radar shows AILANG-readiness across three commercial concerns. High means handbook.gitlab.com is already strong there; low means AILANG could meaningfully help.
§2 · what an AI sees on handbook.gitlab.com
The GitLab Handbook documents the company's culture, values, and operational practices, with a strong focus on all-remote work methodologies. It provides comprehensive guides for employees, managers, and teams on topics like remote collaboration, diversity, inclusion, and asynchronous communication, serving as a public resource for how GitLab operates.
Structural extraction — the same content an AI agent would consume from this page.
7 sections — page skeleton
15 headings
6 images
8 list items
12 links
# Security at GitLab | The GitLab Handbook
*Header:*
[The GitLab Handbook](https://handbook.gitlab.com/)
- [GitLab](https://about.gitlab.com/)
- [Handbook](https://handbook.gitlab.com/handbook/)
- Light
Dark
Auto
- Light
- Dark
- Auto
- [The Handbook](https://handbook.gitlab.com/handbook/)
[GitLab Values](https://handbook.gitlab.com/handbook/values/)
[About GitLab](https://handbook.gitlab.com/handbook/company/)
[AMAs](https://handbook.gitlab.com/handbook/company/amas/)
[Being a public company](https://handbook.gitlab.com/handbook/company/being-a-public-company/)
[Cadence](https://handbook.gitlab.com/handbook/company/cadence/)
[E-Group offsite](https://handbook.gitlab.com/handbook/company/offsite/)
[Be clear about sticky bears](https://handbook.gitlab.com/handbook/company/offsite/beware-sticky-bears/)
[E-Group Weekly](https://handbook.gitlab.com/handbook/company/e-group-weekly/)
[Family and Friends Day](https://handbook.gitlab.com/handbook/company/family-and-friends-day/)
[General guidance to OKRs](https://handbook.gitlab.com/handbook/company/okrs/)
[GitLab All-Company Meetings](https://handbook.gitlab.com/handbook/company/gitlab-all-company-meetings/)
[GitLab Culture](https://handbook.gitlab.com/handbook/company/culture/)
[Executive Connect events](https://handbook.gitlab.com/handbook/company/culture/exec-connect/)
[All Remote](https://handbook.gitlab.com/handbook/company/culture/all-remote/)
[A complete guide to the benefits of an all-remote company](https://handbook.gitlab.com/handbook/company/culture/all-remote/remote-benefits/)
[All-Remote Meetings](https://handbook.gitlab.com/handbook/company/culture/all-remote/meetings/)
[Building and reinforcing a sustainable remote work culture](https://handbook.gitlab.com/handbook/company/culture/all-remote/building-culture/)
[Combating burnout, isolation, and anxiety in the remote workplace](https://handbook.gitlab.com/handbook/company/culture/all-remote/mental-health/)
[Considerations for working while traveling](https://handbook.gitlab.com/handbook/company/culture/all-remote/working-while-traveling/)
[GitLab for Remote Teams](https://handbook.gitlab.com/handbook/company/culture/all-remote/gitlab-for-remote/)
[GitLab Meeting Best Practices: Live Doc Meetings](https://handbook.gitlab.com/handbook/company/culture/all-remote/live-doc-meetings/)
[GitLab's Guide to All-Remote](https://handbook.gitlab.com/handbook/company/culture/all-remote/guide/)
[Remote Guide for Design Teams](https://handbook.gitlab.com/handbook/company/culture/all-remote/guide/design/)
[Remote Guide for Finance Teams](https://handbook.gitlab.com/handbook/company/culture/all-remote/guide/finance/)
[Remote Guide for Legal Teams](https://handbook.gitlab.com/handbook/company/culture/all-remote/guide/legal/)
[Remote Guide for People Operations](https://handbook.gitlab.com/handbook/company/culture/all-remote/guide/people-operations/)
[How do you collaborate and whiteboard remotely?](https://handbook.gitlab.com/handbook/company/culture/all-remote/collaboration-and-whiteboarding/)
[Collaborative Whiteboard Configurations](https://handbook.gitlab.com/handbook/company/culture/all-remote/collaboration-and-whiteboarding/setups/)
[How to be a great remote manager - the complete guide](https://handbook.gitlab.com/handbook/company/culture/all-remote/being-a-great-remote-manager/)
[How to create the perfect home office setup for remote working](https://handbook.gitlab.com/handbook/company/culture/all-remote/workspace/)
[How to embrace asynchronous communication for remote work](https://handbook.gitlab.com/handbook/company/culture/all-remote/asynchronous/)
[Informal Communication in an all-remote environment](https://handbook.gitlab.com/handbook/company/culture/all-remote/informal-communication/)
[Our long-term vision for remote work](https://handbook.gitlab.com/handbook/company/culture/all-remote/remote-vision/)
[Parenting as a remote worker](https://handbook.gitlab.com/handbook/company/culture/all-remote/parenting/)
[Remote work emergency plan: What to do (and where to start)](https://handbook.gitlab.com/handbook/company/culture/all-remote/remote-work-emergency-plan/)
[Remote/work-from-home starter guide](https://handbook.gitlab.com/handbook/company/culture/all-remote/remote-work-starter-guide/)
[Scaling an all-remote team](https://handbook.gitlab.com/handbook/company/culture/all-remote/scaling/)
[The 10 models of remote and hybrid work](https://handbook.gitlab.com/handbook/company/culture/all-remote/stages/)
[The complete guide to asynchronous and non-linear working](https://handbook.gitlab.com/handbook/company/culture/all-remote/non-linear-workday/)
[The complete guide to remote onboarding for new-hires](https://handbook.gitlab.com/handbook/company/culture/all-remote/onboarding/)
[The complete guide to starting a remote job](https://handbook.gitlab.com/handbook/company/culture/all-remote/getting-started/)
[The definitive guide to all-remote work and its drawbacks](https://handbook.gitlab.com/handbook/company/culture/all-remote/drawbacks/)
[The definitive guide to remote internships](https://handbook.gitlab.com/handbook/company/culture/all-remote/internship/)
[The GitLab Test — 12 Steps to Better Remote](https://handbook.gitlab.com/handbook/company/culture/all-remote/the-gitlab-test-remote-work/)
[The importance of a handbook-first approach to communication](https://handbook.gitlab.com/handbook/company/culture/all-remote/handbook-first/)
[The phases of remote adaptation](https://handbook.gitlab.com/handbook/company/culture/all-remote/phases-of-remote-adaptation/)
[The Remote Work Report 2021](https://handbook.gitlab.com/handbook/company/culture/all-remote/remote-work-report/)
[What not to do when implementing remote: don't replicate the in-office experience remotely](https://handbook.gitlab.com/handbook/company/culture/all-remote/what-not-to-do/)
[Why GitLab uses the term all-remote to describe its 100% remote workforce](https://handbook.gitlab.com/handbook/company/culture/all-remote/terminology/)
[Work-From-Home Field Guide](https://handbook.gitlab.com/handbook/company/culture/all-remote/work-from-home-field-guide/)
[Cross-Culture Collaboration Guide](https://handbook.gitlab.com/handbook/company/culture/cross-culture-collaboration-guide/)
[Diversity, Inclusion & Belonging](https://handbook.gitlab.com/handbook/company/culture/inclusion/)
[ Recognizing Bias in Decision-Making](https://handbook.gitlab.com/handbook/company/culture/inclusion/unconscious-bias/)
[Advisory Group Members](https://handbook.gitlab.com/handbook/company/culture/inclusion/advisory-group-members/)
[Being Inclusive](https://handbook.gitlab.com/handbook/company/culture/inclusion/being-inclusive/)
[DIB Working Group](https://handbook.gitlab.com/handbook/company/culture/inclusion/dib-working-groups/)
[Inclusive Practices](https://handbook.gitlab.com/handbook/company/culture/inclusion/dib-working-groups/inclusive-practices/)
[Diversity Inclusion & Belonging Communications Strategy](https://handbook.gitlab.com/handbook/company/culture/inclusion/dib-communications-strategy/)
[Engineering Initiatives](https://handbook.gitlab.com/handbook/company/culture/inclusion/engineering-initiatives/)
[Identity data](https://handbook.gitlab.com/handbook/company/culture/inclusion/identity-data/)
[Leadership Diversity Inclusion & Belonging Council](https://handbook.gitlab.com/handbook/company/culture/inclusion/leadership-dib-council/)
[Neurodivergence and NeuroInclusion at GitLab](https://handbook.gitlab.com/handbook/company/culture/inclusion/neurodiversity-and-neuroinclusion/)
[NeuroInclusion in Practice](https://handbook.gitlab.com/handbook/company/culture/inclusion/neurodiversity-and-neuroinclusion/neuroinclusion-in-practice/)
[Support, Accommodations & Resources](https://handbook.gitlab.com/handbook/company/culture/inclusion/neurodiversity-and-neuroinclusion/neurodiversity-resources/)
[Understanding Neurodivergence](https://handbook.gitlab.com/handbook/company/culture/inclusion/neurodiversity-and-neuroinclusion/understanding-neurodivergence/)
[Speaker Series](https://handbook.gitlab.com/handbook/company/culture/inclusion/dib-speaker-series/)
[Sponsorship Program Guide](https://handbook.gitlab.com/handbook/company/culture/inclusion/dib-sponsorship/)
[The Ally Lab](https://handbook.gitlab.com/handbook/company/culture/inclusion/being-an-ally/)
[TMxG – Team Member Resource and Advocacy Group Guide](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/)
[GitLab Mental Health Team Member Advocacy Group (TMAG)](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmag-mental-health/)
[TMAG - Generational Understanding](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmag-gitlab-generational-understanding/)
[TMRG - API (Asian-Pacific Islander)](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-api/)
[TMRG - Black@GitLab](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-black/)
[TMRG - Caregivers](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-caregivers/)
[TMRG - Gente](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-gente/)
[TMRG - GitLab Disability & Neurodivergence](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/erg-gitlab-diversability/)
[TMRG - GitLab Pride](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-pride/)
[The GitLab Pride Mentorship](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-pride/mentorship-program/)
[TMRG - GitLab Women](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-women/)
[Activate your Agile Career](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-women/agile-career/)
[The GitLab Mentorship Program hosted by the Women TMRG](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-gitlab-women/mentorship-program/)
[TMRG - Global Voices](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/tmrg-global-voices/)
[TMxG Leadership Resources](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/)
[Definitions: What Counts?](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/definitions/)
[Event Planning Guide](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/event-planning/)
[Executive Sponsorship for TMxGs](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/executive-sponsorship/)
[Measuring Impact](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/measuring-impact/)
[Quarterly Planning Guide](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/quarterly-planning/)
[Templates & Tools](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/leaders/templates/)
[GitLab CEO 101](https://handbook.gitlab.com/handbook/company/culture/gitlab-101/)
[GitLab Events Code of Conduct](https://handbook.gitlab.com/handbook/company/culture/ecoc/)
[GitLab Songbook](https://handbook.gitlab.com/handbook/company/culture/songbook/)
[GitLab Summit](https://handbook.gitlab.com/handbook/company/culture/summit/)
[Previous GitLab Contributes & Summits](https://handbook.gitlab.com/handbook/company/culture/summit/previous/)
[GitLab Environmental, Social, and Governance (ESG)](https://handbook.gitlab.com/handbook/company/esg/)
[GitLab licensing technology to independent Chinese company FAQ](https://handbook.gitlab.com/handbook/company/faq-gitlab-licensing-technology-to-independent-chinese-company/)
[GitLab Mission](https://handbook.gitlab.com/handbook/company/mission/)
[GitLab Purpose](https://handbook.gitlab.com/handbook/company/purpose/)
[GitLab Vision](https://handbook.gitlab.com/ha
Couldn't render a preview for this site. Open the URL in a new tab ↗
Screenshot via thum.io
§3 · AILANG × your business
handbook.gitlab.com scored 4/10 on privacy. AILANG opportunity is therefore 6/10. Here's where it would land first.
Mark fields containing PII at the type level. The compiler refuses to let a labelled value reach a public sink without an explicit Declassify boundary. Privacy by type, not by code review.
type Customer = { email: string<pii>, postcode: string<pii>, signupDate: string } -- assigning customer.email to a log line is a type error.→ AILANG docs
A function declares the network endpoints, file paths, and AI providers it touches. Anything outside the declaration is rejected by the runtime. "This part of the system can talk to Stripe; it cannot talk to anyone else" is enforced.
func chargeCard(c: Card) -> Result[Receipt, Error] ! {Net @endpoint="api.stripe.com", AI @limit=0}→ AILANG docs
The same module runs in the browser via WASM, on Cloud Run, and as a native binary. Sensitive workflows can stay in the user's tab — no server ever sees the data.
-- Browser: load AILANG WASM, run the module in the user's tab. -- Cloud Run: same .ail file packaged as a container. -- Native CLI: same .ail file, ailang run.→ AILANG docs
func sketchSite(url: string<pii>, topic: Topic) -> Sketch
! {Net @limit=1, AI @limit=5, FS @limit=4, Process, Declassify}
| Signal | Topic | Result | Points | AILANG primitive |
|---|---|---|---|---|
| agent.json referenced | agent-ready | ✗ | 0/1 | ailang serve-api generates A2A agent cards automatically — bonus if you're an early adopter |
| openapi.json referenced | agent-ready | ✗ | 0/2 | ailang serve-api generates OpenAPI 3.1 from Hindley-Milner type signatures |
| MCP endpoint referenced | agent-ready | ✗ | 0/2 | ailang serve-api --mcp-http exposes typed functions as MCP tools |
| Public API docs linked | agent-ready | ✗ | 0/2 | ailang serve-api hosts Swagger + ReDoc at /api/_meta/ by default |
| Webhooks documented | agent-ready | ✓ | 2/2 | ailang serve-api handles webhooks as typed handler functions with effect-tracked side effects |
| Rate limits documented | agent-ready | ✓ | 2/2 | Capability budgets — Net @limit=N is the symmetric server-side primitive for what agents see as rate limits |
| Streaming / SSE endpoint | agent-ready | ✗ | 0/2 | std/stream — ssePost and Stream effect handle event-source endpoints with typed event types |
| Sandbox / test environment offered | agent-ready | ✓ | 2/2 | ailang --ai-stub plus mock effect handlers — deterministic, capability-scoped fakes for any effect, including Net and AI |
| Authentication documented | agent-ready | ✓ | 2/2 | std/jwt for verification, IFC labels (string |
| Idempotency keys documented | agent-ready | ✗ | 0/2 | Pure functions are idempotent by construction; requires/ensures contracts express idempotence as a static guarantee |
| AG-UI streaming protocol | agent-ready | ✗ | 0/1 | std/stream — the AG-UI event lifecycle (RUN_STARTED → TEXT_MESSAGE_CONTENT → TOOL_CALL_RESULT → RUN_FINISHED) is a textbook sum type. ADTs + exhaustive pattern matching make every event-type branch a compile error to skip. |
| HTTP 402 agent payments (x402 / pay-per-crawl) | agent-ready | ✗ | 0/1 | Net @endpoint-scoped capability budgets bound payment destinations; requires { amount <= budget } gates the payload; IFC labels keep the signed payment key out of public sinks. Same primitives cover x402 payload signing and Cloudflare's crawler-price negotiation. |
| AP2 Agent Payments Protocol | agent-ready | ✗ | 0/1 | Mandates ARE contracts. requires { intent.price <= mandate.maxPrice } + ensures { cart.total <= intent.price } is a one-to-one translation of an Intent/Cart Mandate into AILANG. Z3 can verify the bounds at compile time. |
| UTCP tool-calling protocol | agent-ready | ✗ | 0/1 | Typed function signatures are the manifest. ailang serve-api emits the same metadata as a UTCPManual (name, input/output schema, native endpoint) — direct-call discovery without a proxy server. |
| End-to-end encryption documented | privacy | ✗ | 0/2 | IFC labels (string |
| Compliance certifications cited | privacy | ✓ | 2/2 | requires/ensures contracts express machine-verifiable claims; capability budgets bound audit-trail effects; effect rows leave nothing un-declared |
| Data minimisation language | privacy | ✗ | 0/2 | Capability scoping — each Net call declares its endpoint in the effect row, so "doesn't sell" becomes a type-system-enforceable claim, not a marketing one |
| Third-party domains restrained | privacy | ✗ | 0/2 | Capability scoping — each Net call declares its endpoint in the effect row |
| Data residency / on-prem language | privacy | ✓ | 2/2 | Three-runtime deploy — same module runs in WASM (browser), Cloud Run, and native CLI |
| Single-vendor LLM language | portable | ○ | 2/2 | std/ai multi-provider — switch from Anthropic to Gemini to OpenAI without rewriting |
| Multiple AI providers cited | portable | ✓ | 2/2 | std/ai — one Step API across Anthropic, OpenAI, Gemini, OpenRouter, Ollama, and custom-package providers |
| Cross-runtime / deployment portability | portable | ✓ | 2/2 | Effect handlers as runtime adapters — same .ail runs as WASM in the browser, a Cloud Run container, and a native CLI; only the handlers change |
| BYO key / model-agnostic | portable | ✗ | 0/2 | AILANG WASM — the full interpreter ships as a browser bundle, so caller-held keys (BYOK), offline apps, and embedded demos all work client-side |
The rubric that scored this page is open-source AILANG code — every signal extractor is contract-verified. View rubric →