gemini-cli - 💡(How to fix) Fix OAuth/Policy Error: "Tool execution denied by policy" prevents basic read/write tool usage [1 participants]

The Gemini CLI is consistently throwing a Tool execution denied by policy error. This is a generalized blockade affecting all tool invocations, but it severely impacts fundamental I/O operations (file reading, file writing, and shell command execution). The environment security system actively blocks these tools, rendering file-dependent workflows and codebase context gathering completely unusable. The CLI should successfully execute read/write file operations and shell commands when requested by the prompt. Or, otherwise, at least ask for permittion to do it (do not happen). If there is a missing scope or local configuration preventing tool usage, the CLI should output a clear, actionable error message pointing to the specific IAM permission or local tool_execution_policy flag, rather than a generic policy denial. The CLI should successfully execute read/write file operations and shell commands when requested by the prompt. If there is a missing scope or local configuration preventing tool usage, the CLI should output a clear, actionable error message pointing to the specific IAM permission or local tool_execution_policy flag, rather than a generic policy denial.

TL;DR

The Gemini CLI's "Tool execution denied by policy" error may be resolved by adjusting the tool_execution_policy flag or verifying the OAuth scopes to match the Vertex AI/Google AI Studio backend requirements.

Guidance

• Review the OAuth scopes used for authentication to ensure they align with the requirements for tool execution in Vertex AI/Google AI Studio.
• Check the tool_execution_policy flag in the local configuration to see if it's set to a restrictive mode that's causing the denial.
• Verify that the Gemini CLI version (0.37.1) is compatible with the Vertex AI/Google AI Studio backend and that there are no known issues with this version.
• Consider checking the documentation for any specific IAM permissions required for tool execution and ensure they are properly configured.

Example

No specific code example is provided as the issue seems to be related to configuration and authentication rather than code.

Notes

The issue might be due to an overly restrictive default architecture or a mismatch between documented OAuth scopes and actual backend requirements. Further investigation into the specific requirements for Vertex AI/Google AI Studio and the configuration of the Gemini CLI is needed.

Recommendation

Apply workaround: Adjust the tool_execution_policy flag or OAuth scopes to match the requirements for tool execution in Vertex AI/Google AI Studio, as the issue seems to stem from a configuration or authentication mismatch rather than a version-related problem.