---
title: "Govern Gemini CLI"
---

# Govern Gemini CLI

Apply Neural Inverse Govern agent policy to Gemini CLI through its system overrides file, why the hook is advisory, and how Gemini CLI activity is monitored.

## Control level

| What | Level |
|---|---|
| Kinds the policy denies outright | **Managed configuration**: removed with `tools.exclude` in the system overrides file |
| Other actions | **Advisory hook**: a developer can disable it |
| Model traffic | **Not routable**: the gateway does not serve Google's native Gemini API |
| Activity | **Monitored** through OpenTelemetry events to vendor audit |

Gemini CLI 0.64.0 was run for real with the compiled settings and the real endpoint agent: a denied `rm -rf` was refused (in YOLO mode too) and an allowed `ls` ran. The same deny was bypassed when the developer listed the hook in `hooksConfig.disabled`. That is why Gemini CLI is not Enforced.

## 1. Write the policy and enrol the machine

Write rules in **Agent policy** ([Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)) and enrol the machine with the endpoint agent ([Deploy](https://neuralinverse.com/docs/deploy/)). The agent fetches the policy compiled for the `gemini-cli` engine and installs `settings.json` as Gemini CLI's system overrides file:

| OS | Location |
|---|---|
| Linux | `/etc/gemini-cli` |
| macOS | `/Library/Application Support/GeminiCli` |
| Windows | `C:\ProgramData\gemini-cli` |

The file sets `hooks.BeforeTool` running Govern's enforcement hook on every tool, `hooksConfig.enabled`, and `tools.exclude` for each kind the policy denies outright.

## 2. What a developer can bypass

- `hooksConfig.disabled` is merged from user settings, so a developer can disable the hook by name.
- Hooks do not run in folders the developer has not trusted.
- `GEMINI_CLI_SYSTEM_SETTINGS_PATH` can point to another file.
- Gemini CLI lets a call run on a timeout or on any exit status but 0 and 2; the compiled command turns other failures into exit 2.
- Hooks answer only allow or deny, so an `ask` rule becomes a deny.

What `tools.exclude` removes stays removed: that is the managed configuration part. Check the gaps on **Agent policy > Policy preview** with the engine `gemini-cli`.

## Monitoring

Gemini CLI can push OpenTelemetry events to Govern's vendor audit receiver; see [Evidence](https://neuralinverse.com/docs/evidence/).