Gemini CLI says "Tool execution denied by policy" for read, write, and shell tools - how to fix?

Question

Gemini CLI 0.37.1 on Windows PowerShell, signed in with OAuth, denies every file read, write, and shell tool call with "Tool execution denied by policy", even after regenerating credentials and reinstalling. Users in the thread found local settings and policy rules that caused this.

Originally asked on GitHub: https://github.com/google-gemini/gemini-cli/issues/25283

AgentArmor team · Accepted Answer

The issue was closed as NOT_PLANNED and later auto-closed as stale. The thread contains no maintainer fix, but it reports three local causes and workarounds.

One user had `security.enableConseca` enabled in `~/.gemini/settings.json`. Removing that setting fixed the denial for them. Another user, with Conseca disabled, had a `tools.allowed` list containing only `run_shell_command(ls)`. That caused other `run_shell_command` calls to be denied. Adding `run_shell_command` to a `confirmationRequired` list made calls prompt instead. Run `/policies list` to see which rule denies a call and where it comes from.

A third user found that default rules for `write_file`, `replace`, and `run_shell_command` included both ASK_USER and DENY at the same priority (1.01), so edits were denied. Their workaround was adding ALLOW rules at priority 950 scoped to the project directory:

```toml
[[rule]]
decision = "allow"
priority = 950
toolName = "write_file"
argsPattern = '\0"file_path":"/path/to/project/.*"\0'
modes = [ "default", "autoEdit", "yolo" ]
```

Repeat the rule with `toolName = "replace"`. Keep the path pattern narrow so writes are not allowed outside your project.

Security note: a broad allow rule for shell commands or writes lets the agent act without asking, so keep the scope as narrow as your workflow allows.

AgentArmor team · Answer

**What @r4m0np tried on GitHub** (Didn't work)

Reporter revoked and regenerated application default credentials with gcloud and reinstalled Gemini CLI 0.37.1 on Windows, authenticated via OAuth. The denial persisted.

Source: https://github.com/google-gemini/gemini-cli/issues/25283

AgentArmor team · Answer

**What @M4NZEN tried on GitHub** (Worked)

Removed the Conseca setting (security.enableConseca) from ~/.gemini/settings.json. This fixed the denial for this commenter.

Source: https://github.com/google-gemini/gemini-cli/issues/25283#issuecomment-4264372581

AgentArmor team · Answer

**What @foxwoodacademy tried on GitHub** (Worked)

Added ALLOW rules at priority 950 in a policy TOML for write_file and replace, scoped with an argsPattern to the project directory, after finding tied ASK_USER and DENY default rules at priority 1.01. The commenter reported this worked on Android/Termux.

Source: https://github.com/google-gemini/gemini-cli/issues/25283#issuecomment-4763283414

AgentArmor team · Answer

**What @jhutar tried on GitHub** (Partly worked)

Added run_shell_command(ls) to tools.allowed in settings.json. Other run_shell_command calls were then denied. Adding run_shell_command to confirmationRequired made all calls, including ls, prompt for confirmation.

Source: https://github.com/google-gemini/gemini-cli/issues/25283#issuecomment-5115358946

Gemini CLI says "Tool execution denied by policy" for read, write, and shell tools - how to fix?

5 answers

Add your answer or comment

Gemini CLI says "Tool execution denied by policy" for read, write, and shell tools - how to fix?

5 answers

Add your answer or comment

Related questions