google-gemini/gemini-cli · critical · FatalConfigError

YOLO mode is disabled by your administrator. To enable it, p

Error message

YOLO mode is disabled by your administrator. To enable it, please request an update to the settings at: https://goo.gle/manage-gemini-cli

What it means

Thrown as a `FatalConfigError` when the resolved approval mode is `YOLO` but an administrator has locked it down via either `settings.security.disableYoloMode` or `settings.admin.secureModeEnabled`. The error message is built by `getAdminErrorMessage` and points users at the admin manage URL. Because YOLO auto-approves every tool call, admin policy treats it as a security boundary and refuses to start the session.

Source

Thrown at packages/cli/src/config/config.ts:747

        );
    }
  } else {
    approvalMode = ApprovalMode.DEFAULT;
  }

  // Override approval mode if disableYoloMode is set.
  if (settings.security?.disableYoloMode || settings.admin?.secureModeEnabled) {
    if (approvalMode === ApprovalMode.YOLO) {
      if (settings.admin?.secureModeEnabled) {
        debugLogger.error(
          'YOLO mode is disabled by "secureModeEnabled" setting.',
        );
      } else {
        debugLogger.error(
          'YOLO mode is disabled by the "disableYolo" setting.',
        );
      }
      throw new FatalConfigError(
        getAdminErrorMessage('YOLO mode', undefined /* config */),
      );
    }
  } else if (approvalMode === ApprovalMode.YOLO) {
    debugLogger.warn(
      'YOLO mode is enabled. All tool calls will be automatically approved.',
    );
  }

  // Force approval mode to default if the folder is not trusted.
  if (!trustedFolder && approvalMode !== ApprovalMode.DEFAULT) {
    debugLogger.warn(
      `Approval mode overridden to "default" because the current folder is not trusted.`,
    );
    approvalMode = ApprovalMode.DEFAULT;
  }

  let telemetrySettings;

View on GitHub (pinned to 5024443c72)

Solutions

1. Drop the `--yolo` flag and the `yolo` setting; use `default` or `auto_edit` instead.
2. Request an administrator update the managed settings (URL in the error message).
3. In scripts, detect `disableYoloMode`/`secureModeEnabled` before passing `--yolo`.

Example fix

// before
gemini --yolo -p "refactor this"
// after
gemini --approval-mode default -p "refactor this"

function canUseYolo(settings: MergedSettings): boolean {
  return !settings.security?.disableYoloMode && !settings.admin?.secureModeEnabled;
}
if (!canUseYolo(settings) && approvalMode === 'yolo') {
  throw new Error('YOLO disabled by admin policy; use default or auto_edit.');
}

function yoloAllowed(settings: unknown): boolean {
  const s = (settings ?? {}) as { security?: { disableYoloMode?: boolean }, admin?: { secureModeEnabled?: boolean } };
  return !s.security?.disableYoloMode && !s.admin?.secureModeEnabled;
}

When it happens

Trigger: User passes `--yolo` or sets `defaultApprovalMode: yolo` while the org/admin config sets `disableYoloMode: true` or `secureModeEnabled: true`; a managed enterprise install with secure mode enforced; CI scripts that hard-code `--yolo` against a locked-down deployment.

Common situations: Enterprise / managed Gemini CLI installations; shared machines with secure mode; users unaware their settings file was centrally provisioned; scripts ported from a personal machine where YOLO was allowed.

Related errors

• Installing extension from source "${installMetadata.source}"
• Installing extensions from remote sources is disallowed by y
• ${this.commandName} cannot be run. Blocked command: "${comma
• Shell command confirmation required
• Path validation failed: ${pathError}

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/9c71be8046ae88ea. Report an issue: GitHub.