Roll ACP out to Gemini CLI seats

Gemini CLI is the harness where the honest answer is “part of it.” Google gives admins two layers with very different strength, and only one of them carries ACP today. Google’s enterprise, Enterprise Admin Controls, configuration reference, and hooks pages are the source for everything below. Read the shape all four harnesses share first if you haven’t.

The two admin layers

System settings files. /etc/gemini-cli/settings.json on Linux, /Library/Application Support/GeminiCli/settings.json on macOS, C:\ProgramData\gemini-cli\settings.json on Windows, with a separate system-defaults.json for a baseline. The system override file wins over user and workspace settings for most keys. Google’s docs say plainly that this is not a security boundary: the path can be redirected with GEMINI_CLI_SYSTEM_SETTINGS_PATH, and a user with sufficient local privilege can circumvent it.

Enterprise Admin Controls. Delivered from Google’s management console, enforced globally, and immutable at the local level. They cover strict mode (blocks yolo mode), extensions, MCP on or off, an MCP server allowlist, required MCP servers, and skills. They do not cover hooks.

What carries ACP today: a required MCP server

Enterprise Admin Controls can inject an MCP server into every user’s session, remote transport only, with an auth provider. That matches ACP’s endpoint, which is remote and signs people in with MCP OAuth:

{
  "requiredMcpServers": {
    "acp": {
      "url": "https://api.agenticcontrolplane.com/mcp",
      "type": "http",
      "trust": false,
      "description": "Agentic Control Plane: policy checks, audit, cost X-ray",
      "authProviderType": "dynamic_discovery"
    }
  }
}

Paired with the allowlist so nothing else can be added locally:

{
  "mcpServers": {
    "acp": { "url": "https://api.agenticcontrolplane.com/mcp", "type": "http" }
  }
}

That gives every Gemini CLI seat the ACP introspection tools and rule proposals, attributed to the signed-in person, with nothing written to any machine. trust: false keeps Gemini’s own confirmation on ACP’s tools; the rule-proposal tool never applies policy by itself, so true is defensible too.

Two things to know about this path:

• It is not per-call enforcement of Gemini CLI’s native tools. A model that calls run_shell_command isn’t checked against workspace policy on the way through. It is the audit and introspection plane, and a chokepoint for any tool you route through ACP’s MCP server.
• ACP’s endpoint is the same one Codex and Claude Code sign in to with MCP OAuth. Gemini CLI’s dynamic_discovery provider is the standard discovery flow, so it is expected to work, and we have not yet exercised it from Gemini CLI ourselves.

What doesn’t carry ACP yet: hooks

Gemini CLI has a hooks system with its own events, BeforeTool and AfterTool among eleven, its own JSON schema, and its own response contract (decision: "deny" with a reason, or exit code 2). It’s a different wire format from the Claude Code contract that Codex and Cursor adopted and that ACP’s hook script speaks, so ACP ships no Gemini CLI hook adapter today. The Antigravity adapter shares the ~/.gemini config namespace, but it targets Antigravity’s events, not Gemini CLI’s.

Even with an adapter, the enforcement story would be weaker than Codex or Claude Code’s. In Gemini’s precedence for hooks specifically, project settings rank above user settings, which rank above system settings. A system-level hook is a default a user can override, and the Enterprise Admin Controls, the layer that is actually immutable, don’t carry hooks at all. The adapter is tracked with the rest of the enterprise work in gatewaystack-connect #943.

What the admin controls can lock down meanwhile

Google’s own controls, independent of ACP, that most enterprises will want on:

• Strict mode (admin.secureModeEnabled): blocks yolo mode. In system settings, security.disableYoloMode and security.disableAlwaysAllow are the user-circumventable equivalents.
• MCP allowlist (admin.mcp.config): once non-empty, locally configured servers not on the list are ignored, and a listed server’s url, type, and trust come from the admin side.
• Extensions and skills off (admin.extensions.enabled, admin.skills.enabled): no extension allowlist exists yet, so the choice is all or nothing.
• Admin policies: TOML rules in /etc/gemini-cli/policies (Linux), /Library/Application Support/GeminiCli/policies (macOS), C:\ProgramData\gemini-cli\policies (Windows), root-owned. Admin tier always overrides user, workspace, and default policies, and can deny or ask_user by tool name, MCP name, or command prefix. This is Gemini’s per-machine rule file; what a rules file can and can’t do applies.

Related

• Enterprise rollout: the shape all harnesses share
• Antigravity integration — the adapter that shares Gemini’s config namespace
• Antigravity native controls
• Google: Enterprise · Enterprise Admin Controls · Configuration reference · Policy engine

curl -sf https://agenticcontrolplane.com/install.sh | bash