Google has shipped plan mode in Gemini CLI, a read-only agent configuration that restricts the toolset to navigation and research while blocking any file modifications. The feature, announced March 11, 2026 on the Google Developers Blog, is now enabled by default for all Gemini CLI users. The mode separates the thinking phase from the doing phase: it routes to higher-reasoning Pro models for architectural planning and switches to faster models once execution begins.
The core mechanism is a tool allowlist. When plan mode is active, Gemini CLI can call only read_file, list_directory, glob, grep_search, google_web_search, web_fetch, get_internal_docs, codebase_investigator, cli_help, and ask_user. Write operations are blocked unless they target the agent's own internal plan files. The intent is for the agent to map dependencies, identify patterns, and propose a solution before any code is touched.
The ask_user tool is the underrated piece. Rather than guessing at ambiguous requirements, the agent can pause mid-research and pose clarifying questions back to the developer. "This allows the agent to pause its research and ask you targeted questions to clarify your goals or gather missing information," the announcement notes. The result is a plan the developer has agreed to, not a plan the agent inferred incorrectly.
Model routing extends this separation. According to DevOps.com, plan mode automatically routes to Gemini 3.1 Pro for architectural decisions and switches to faster models when shifting to implementation. The reasoning tier and the execution tier are not the same compute.
Plan mode is not limited to the local filesystem. It supports read-only MCP (Model Context Protocol) tools, meaning an agent in plan mode can pull context from GitHub issues, Postgres schemas, or Google Docs without risking a stray write to the codebase. The Gemini CLI documentation lists the full tool allowlist. The policy engine underneath accepts TOML rules with a five-tier priority system and supports MCP tool wildcards including mcpName and toolAnnotations fields — a flexible gate for enterprises building custom approval workflows.
Google is not stopping at the default-on safety blanket. The Conductor extension, also announced alongside plan mode, layers on top of it. Conductor runs pre-flight research in plan mode, uses ask_user for milestone confirmations at each stage, and acts as an orchestrator for multi-step development tracks — complex migrations, feature implementations that span multiple PRs. The Google team has signaled that Conductor is destined to become a native mode built into Gemini CLI rather than a separate extension.
What this points to is a pattern in agent infrastructure: the read-only planning phase as a structural layer, not a bolted-on policy. The CLI's default flip from "agent can do things" to "agent will only think until you agree" treats the write as the expensive, irreversible operation that requires developer opt-in.
The irony is not lost: an AI agent built to modify your codebase is now, by default, a read-only research assistant. Whether developers keep that default in production workflows, or disable it for speed, is the open question.
