Control level
| What | Level |
|---|---|
| Kinds the policy denies outright | Managed configuration: removed with tools.exclude in the system overrides file |
| Other actions | Advisory hook: a developer can disable it |
| Model traffic | Not routable: the gateway does not serve Google's native Gemini API |
| Activity | Monitored through OpenTelemetry events to vendor audit |
Gemini CLI 0.64.0 was run for real with the compiled settings and the real endpoint agent: a denied rm -rf was refused (in YOLO mode too) and an allowed ls ran. The same deny was bypassed when the developer listed the hook in hooksConfig.disabled. That is why Gemini CLI is not Enforced.
1. Write the policy and enrol the machine
Write rules in Agent policy (Agent policy) and enrol the machine with the endpoint agent (Deploy). The agent fetches the policy compiled for the gemini-cli engine and installs settings.json as Gemini CLI's system overrides file:
| OS | Location |
|---|---|
| Linux | /etc/gemini-cli |
| macOS | /Library/Application Support/GeminiCli |
| Windows | C:\ProgramData\gemini-cli |
The file sets hooks.BeforeTool running Govern's enforcement hook on every tool, hooksConfig.enabled, and tools.exclude for each kind the policy denies outright.
2. What a developer can bypass
hooksConfig.disabledis merged from user settings, so a developer can disable the hook by name.- Hooks do not run in folders the developer has not trusted.
GEMINI_CLI_SYSTEM_SETTINGS_PATHcan point to another file.- Gemini CLI lets a call run on a timeout or on any exit status but 0 and 2; the compiled command turns other failures into exit 2.
- Hooks answer only allow or deny, so an
askrule becomes a deny.
What tools.exclude removes stays removed: that is the managed configuration part. Check the gaps on Agent policy > Policy preview with the engine gemini-cli.
Monitoring
Gemini CLI can push OpenTelemetry events to Govern's vendor audit receiver; see Evidence.