Read-only by default?

[palladius]

Hi! I think this extension is VERY powerful and I love it!
However, a number of people I talked to and I are convinced it's possibly TOO powerful.
I was wondering if we could inject some safety-by-default behaviour. Example:

• Read-Only access granted by default.
• Write access granted with per-scope / per-product ENV variables:
  • `GEMINI_CLI_WOORKSPACE_GMAIL_WRITE_ACCESS=TRUE"
  • `GEMINI_CLI_WOORKSPACE_CALENDAR_WRITE_ACCESS=TRUE"
  • ...

[allenhutchison]

This is probably better handled with a local policy config. I put up a blog post on this today: https://allen.hutchison.org/2025/11/26/the-guardrails-of-autonomy/ and the docs are here: https://geminicli.com/docs/core/policy-engine/

If you enable the policy engine in Gemini CLI you can have a policy that will return the DENY state for any of the tools you choose.

[palladius]

Thanks Allen,
I'll play with your solution and if you're happy I'm going to blog about it.

[allenhutchison]

No problem with writing a blog on this from my perspective. Here is the policy file I use with this extension:

❯ more ~/.gemini/policies/google-workspace.toml
# Google Workspace Read-Only Tools
# These tools are allowed for querying Google Workspace data

# Calendar Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "calendar.findFreeTime",
  "calendar.list",
  "calendar.listEvents",
]
decision = "allow"
priority = 100

# Chat/Spaces Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "chat.findDmByEmail",
  "chat.findSpaceByName",
  "chat.getMessages",
  "chat.listSpaces",
  "chat.listThreads",
]
decision = "allow"
priority = 100

# Docs Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "docs.extractIdFromUrl",
  "docs.find",
  "docs.getText",
]
decision = "allow"
priority = 100

# Drive Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "drive.findFolder",
  "drive.search",
]
decision = "allow"
priority = 100

# Gmail Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "gmail.get",
  "gmail.listLabels",
  "gmail.search",
]
decision = "allow"
priority = 100

# People/Contacts Tools
[[rule]]
mcpName = "google-workspace"
toolName = [
  "people.getMe",
  "people.getUserProfile",
]
decision = "allow"
priority = 100

This captures most of the read only tools and makes the allowed by default, all other tools still require a confirmation. You coudl easily adapt this and set the write tools to DENY or set the entire MCP server to deny and then only allow or ask_user for the tools you want to be able to use.