# Gemini CLI Enterprise Rollout — What Admin Controls Can Push, and What ACP Covers Today

Gemini CLI's two admin layers, system settings files and the management-console Enterprise Admin Controls, and exactly which of them can carry ACP today: the required-MCP-server push works with ACP's OAuth endpoint; a system-settings hook is a default users can override, and ACP ships no Gemini CLI hook adapter yet.

# Roll ACP out to Gemini CLI seats

Gemini CLI is the harness where the honest answer is "part of it." Google gives admins two layers with very different strength, and only one of them carries ACP today. Google's [enterprise](https://geminicli.com/docs/cli/enterprise/), [Enterprise Admin Controls](https://geminicli.com/docs/admin/enterprise-controls/), [configuration reference](https://geminicli.com/docs/reference/configuration/), and [hooks](https://github.com/google-gemini/gemini-cli/blob/main/docs/hooks/index.md) pages are the source for everything below. Read the [shape all four harnesses share](/docs/enterprise) first if you haven't.

## The two admin layers

**System settings files.** `/etc/gemini-cli/settings.json` on Linux, `/Library/Application Support/GeminiCli/settings.json` on macOS, `C:\ProgramData\gemini-cli\settings.json` on Windows, with a separate `system-defaults.json` for a baseline. The system override file wins over user and workspace settings for most keys. Google's docs say plainly that this is not a security boundary: the path can be redirected with `GEMINI_CLI_SYSTEM_SETTINGS_PATH`, and a user with sufficient local privilege can circumvent it.

**Enterprise Admin Controls.** Delivered from Google's management console, enforced globally, and immutable at the local level. They cover strict mode (blocks yolo mode), extensions, MCP on or off, an MCP server allowlist, required MCP servers, and skills. They do not cover hooks.

## What carries ACP today: a required MCP server

Enterprise Admin Controls can inject an MCP server into every user's session, remote transport only, with an auth provider. That matches ACP's endpoint, which is remote and signs people in with MCP OAuth:

```json
{
  "requiredMcpServers": {
    "acp": {
      "url": "https://api.agenticcontrolplane.com/mcp",
      "type": "http",
      "trust": false,
      "description": "Agentic Control Plane: policy checks, audit, cost X-ray",
      "authProviderType": "dynamic_discovery"
    }
  }
}
```

Paired with the allowlist so nothing else can be added locally:

```json
{
  "mcpServers": {
    "acp": { "url": "https://api.agenticcontrolplane.com/mcp", "type": "http" }
  }
}
```

That gives every Gemini CLI seat the ACP introspection tools and rule proposals, attributed to the signed-in person, with nothing written to any machine. `trust: false` keeps Gemini's own confirmation on ACP's tools; the rule-proposal tool never applies policy by itself, so `true` is defensible too.

Two things to know about this path:

- It is **not per-call enforcement** of Gemini CLI's native tools. A model that calls `run_shell_command` isn't checked against workspace policy on the way through. It is the audit and introspection plane, and a chokepoint for any tool you route through ACP's MCP server.
- ACP's endpoint is the same one Codex and Claude Code sign in to with MCP OAuth. Gemini CLI's `dynamic_discovery` provider is the standard discovery flow, so it is expected to work, and we have not yet exercised it from Gemini CLI ourselves.

## What doesn't carry ACP yet: hooks

Gemini CLI has a hooks system with its own events, `BeforeTool` and `AfterTool` among eleven, its own JSON schema, and its own response contract (`decision: "deny"` with a reason, or exit code 2). It's a different wire format from the Claude Code contract that Codex and Cursor adopted and that ACP's hook script speaks, so ACP ships no Gemini CLI hook adapter today. The [Antigravity](/integrations/antigravity) adapter shares the `~/.gemini` config namespace, but it targets Antigravity's events, not Gemini CLI's.

Even with an adapter, the enforcement story would be weaker than Codex or Claude Code's. In Gemini's precedence for hooks specifically, project settings rank above user settings, which rank above system settings. A system-level hook is a default a user can override, and the Enterprise Admin Controls, the layer that is actually immutable, don't carry hooks at all. The adapter is tracked with the rest of the enterprise work in [gatewaystack-connect #943](https://github.com/davidcrowe/gatewaystack-connect/issues/943).

## What the admin controls can lock down meanwhile

Google's own controls, independent of ACP, that most enterprises will want on:

- **Strict mode** (`admin.secureModeEnabled`): blocks yolo mode. In system settings, `security.disableYoloMode` and `security.disableAlwaysAllow` are the user-circumventable equivalents.
- **MCP allowlist** (`admin.mcp.config`): once non-empty, locally configured servers not on the list are ignored, and a listed server's `url`, `type`, and `trust` come from the admin side.
- **Extensions** and **skills** off (`admin.extensions.enabled`, `admin.skills.enabled`): no extension allowlist exists yet, so the choice is all or nothing.
- **Admin policies**: TOML rules in `/etc/gemini-cli/policies` (Linux), `/Library/Application Support/GeminiCli/policies` (macOS), `C:\ProgramData\gemini-cli\policies` (Windows), root-owned. Admin tier always overrides user, workspace, and default policies, and can `deny` or `ask_user` by tool name, MCP name, or command prefix. This is Gemini's per-machine rule file; [what a rules file can and can't do](/blog/your-rules-file-is-not-a-policy) applies.

## Related

- [Enterprise rollout: the shape all harnesses share](/docs/enterprise)
- [Antigravity integration](/integrations/antigravity) — the adapter that shares Gemini's config namespace
- [Antigravity native controls](/controls/antigravity)
- Google: [Enterprise](https://geminicli.com/docs/cli/enterprise/) · [Enterprise Admin Controls](https://geminicli.com/docs/admin/enterprise-controls/) · [Configuration reference](https://geminicli.com/docs/reference/configuration/) · [Policy engine](https://geminicli.com/docs/reference/policy-engine/)