---
title: Git Server
description: A Git Server is a system used to host and manage Git repositories. Agent Privilege secures Git Server applications so that AI agent commits are attributable.
component: privilege
page_id: privilege:agent-privilege:configuration/agentic-apps/git-server
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/agentic-apps/git-server.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: April 28, 2026
page_aliases: ["agent-privilege:git-server.adoc"]
section_ids:
  configure-git-integration-for-ai-agent-commit-tracking: Configure Git integration for AI agent commit tracking
  before-you-begin: Before you begin
  step-1-create-a-git-server-application-in-pingone-privilege: "Step 1: Create a Git Server application in PingOne Privilege"
  result: Result
  step-2-trust-pingone-privilege-ssh-ca-in-github: "Step 2: Trust PingOne Privilege SSH CA in GitHub"
  result-2: Result
  step-3-trust-pingone-privilege-ssh-ca-in-gitlab-saas: "Step 3: Trust PingOne Privilege SSH CA in GitLab SaaS"
  result-3: Result
  step-4-configure-git-policies-for-users-and-ai-agents: "Step 4: Configure Git policies for users and AI agents"
  result-4: Result
---

# Git Server

Agent Privilege can protect sensitive Git servers with just-in-time, least-privilege access with full session visibility and control in front of those Git servers. Agent Privilege acts as an in-line security gateway for integrated Git server applications.

This integration provides:

* Enforcement of time-bound privileged access to Git.

* Credentials insertion that Git servers need.

* Full audit of Git activity.

* Fine-grained access control at the level of individual tools, prompts, and resources.

## Configure Git integration for AI agent commit tracking

Configuration involves creating a Git Server application in PingOne Privilege, configuring GitHub or GitLab to trust PingOne Privilege's SSH CA, and configuring Git policies for users and agents.

### Before you begin

Ensure you have one of the following:

* A GitHub Enterprise organization where you are an organization admin, so you can:

  * Manage SSH certificate authorities under **Settings > Authentication Security > SSH and GPG keys > SSH certificate authorities**.

* A GitLab SaaS group where you can:

  * Generate a **Personal Access Token (PAT)** with the `api` scope.

  * Call the **Group SSH certificates** REST API:

    ```shell
    curl --header "PRIVATE-TOKEN: <YOUR_PRIVATE_TOKEN>"
    --url "https://gitlab.com/api/v4/groups/<YOUR_GROUP_PATH>/ssh_certificates?title=Procyon-CA&key=<YOUR_PROCYON_SSH_CA_KEY>"
    ```

You'll use these permissions to trust the PingOne Privilege SSH CA in your Git providers so that SSH certificates minted by PingOne Privilege for AI agents are accepted.

### Step 1: Create a Git Server application in PingOne Privilege

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. Click **Add Application**.

3. Select **Git Server** as the application type.

4. Configure the application:

   * **Name**: Choose a recognizable internal name.

   * **Type**: Choose GitHub or GitLab.

   * Leave advanced options at default values unless you have specific internal requirements.

5. Save the application.

#### Result

This application represents Git access mediated by PingOne Privilege, using SSH CA authentication instead of user-managed private keys.

### Step 2: Trust PingOne Privilege SSH CA in GitHub

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the **Git Server** app you created, copy the public key.

3. In GitHub Enterprise:

   1. Go to **Settings > SSH and GPG keys**.

   2. Click **New SSH Key**.

   3. Enter a **Title** for the SSH key.

   4. Paste the public key into the **Key** field.

   5. Click **Add SSH key**.

#### Result

GitHub now treats certificates issued by PingOne Privilege as trusted for SSH operations.

### Step 3: Trust PingOne Privilege SSH CA in GitLab SaaS

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the **Git Server** app you created, copy the public key.

3. In GitLab SaaS, create a **Personal Access Token (PAT)** with `api` scope.

4. Use the GitLab Group API to register the CA:

   ```shell
   curl --request POST \
       --header "PRIVATE-TOKEN: <YOUR_PRIVATE_TOKEN" \
       --url "https://gitlab.com/api/v4/groups/<YOUR_GROUP_PATH>/ssh_certificates?title=Procyon-CA&key=<YOUR_PRIVILEGE_SSH_CA_KEY>"
   ```

   |   |                                                                                                                                               |
   | - | --------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | Replace `<YOUR_GROUP_PATH>` with your group path and `<YOUR_PRIVILEGE_SSH_CA_KEY>` with the SSH public key you copied from PingOne Privilege. |

#### Result

GitLab now treats certificates issued by PingOne Privilege as trusted for SSH operations.

### Step 4: Configure Git policies for users and AI agents

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the **Active Applications** tab, click **More Info** in your **Git Server** application.

3. Create or edit a policy and configure:

   * **User mapping:**

     * For each user, specify their GitHub or GitLab username.

     * The username must match exactly what is configured in the Git provider.

   * **Time-bound access**:

     * Configure how long an approval or session remains valid.

   * Optional: **AI push blocking**

     * If required by your security model, enable the option to block code pushes for AI agents.

4. Save the policy.

#### Result

Git access through this application now satisfies Agent Privilege policy decisions.