The Department of War now treats AI-generated code as unverified until it’s proven otherwise. DoW Instruction 8430.01, “Accelerated Mission Software,” took effect September 8, 2026, and is the department’s latest guidance on modernizing and managing software. If you build or buy software for the DoW, the instruction changes what’s required of you for every line AI writes. You have to review and test it to the same standard as human-written code, show where AI touched it, and keep it on systems the department has approved. Here’s what the instruction asks of your team, and how GitLab helps you address it.

What is DoW Instruction 8430.01?

Issued by DoW CIO Kirsten Davies, DoW Instruction 8430.01 applies to every DoW organization and to any acquisition program that includes software, regardless of cost. The instruction sets policy and procedures for modernizing and managing software, with an emphasis on delivering capabilities faster. It directs teams to automate testing and security scanning, reuse what already works, and produce evidence as software is built.

The instruction also encourages teams to use AI, calling AI-assisted development a major force multiplier for speed and quality. However, it attaches three conditions: AI’s role is traceable, its code is verified so developers stay accountable, and government data stays within approved boundaries. Each condition changes what a software platform has to do.

Three requirements that shape AI in delivery

While DoW Instruction 8430.01 covers a wide scope, the three conditions mentioned above show how software platforms must adapt. Here they are in more detail.

1. Traceability: Know what AI touched

Software on DoW networks needs proof of what’s in it and how it was built. When AI is involved, the proof has to cover AI, too: which models, which versions, and which datasets were used to write or test the code.

In GitLab, that record lives beside your code. Dependency Scanning produces your software bill of materials, and audit events and deployment records are generated as part of delivery. Agents in GitLab Duo Agent Platform act through their own service account, tied to the developer who started them, so a commit shows up as the agent acting on behalf of a named person. The commit then lands in the same audit log as everything else, where your SIEM can filter it as AI activity. Because the evidence stays in the platform, you can change models under managed policy without erasing the history.

2. Verification: Check what AI writes

Accelerated delivery cannot compromise security, safety, or supply chain integrity. AI-generated or AI-modified code is unverified input, and a person must approve changes to security-critical functions (a flaw that lets an attacker in) or safety-critical ones (a flaw that can cost lives or platforms). As the instruction states, “Developers and development teams remain fully accountable for the security, functionality, and integrity of any code generated or modified using AI.”

In GitLab, your scans, tests, and approval rules run in the same pipeline for every change, whether a developer or an agent writes the code. Merge request approval policies can require a named reviewer whenever a change touches protected paths or introduces a vulnerability, and protected branches mean an agent can propose but can’t merge past the people you’ve designated.

Dependency Scanning Auto-Remediation (currently in beta) is one example of an agent doing the work while your reviewers still sign off. It proposes dependency upgrades and build fixes, and those proposals wait at your existing approval gates like any other merge request. When GitLab orchestrates agents across several steps, a flow can carry a change through review, tests, scans, and approvals on its own, pausing for a human to sign off before a merge or deploy. Every flow runs under the same identity, policy, and evidence chain as the rest of GitLab, so speed doesn’t mean skipped steps. For teams deciding how much autonomy to give agents, the GitLab Security Standard defines five stages (authorize, isolate, verify, release, and respond) that agents must clear before that autonomy is granted. Those stages are mapped to NIST Secure Software Development Framework (SSDF) and SP 800-53 controls.

3. Data boundaries: Control where AI runs

AI systems must respect data boundaries without compromising intellectual property or classified context. Approved AI services must guarantee that government data and prompts aren’t used to train external models, and non-public DoW information stays on approved DoW systems. That means controlling which models are used and where they are hosted.

GitLab Duo Agent Platform Self-Hosted runs on infrastructure you control, including air-gapped networks. You choose the supported models, on premises or in a private cloud, and can swap them without rebuilding workflows. Requests route through an AI Gateway you deploy yourself, so prompts and responses stay in your environment. For GitLab Dedicated for Government customers, this is the standard setup: You run the AI Gateway in your own environment, connected to the model provider of your choice.

Comply with DoW Instruction 8430.01 today

AI will keep getting faster at writing code. The harder job is showing the code can be trusted, and DoW Instruction 8430.01 asks your team to do exactly that. GitLab keeps that proof with the work: Every AI-assisted change carries its own evidence and audit trail, passes the same gates as human-written code, and runs on models you host and control. Your developers get the same guardrails for AI and non-AI work, without extra tools to learn.

See how GitLab Duo Agent Platform helps defense teams keep AI-generated code governed, auditable, and under human control.