Gemini CLI audit logs: what admins can see, and the gaps

the short answer

Through telemetry you turn on. Gemini CLI’s OpenTelemetry is off by default; once enabled, it emits tool calls with arguments and decisions, file operations and prompts, tagged with a session ID and, when the user is authenticated, their email. Prompt logging defaults to on when telemetry is on, so set logPrompts to false in enterprise settings. Gemini Code Assist can also send prompts and responses to Cloud Logging.

Telemetry: Off by default (telemetry.enabled: false)
Prompt logging: logPrompts defaults to true once telemetry is on
Key event: gemini_cli.tool_call with function_args and decision
Local files: ~/.gemini/tmp/<project_hash>/chats/, 30-day default retention
Failproof: Not a supported harness; ingest only via your own collector

Check Which Gemini CLI You Have First

As of October 2026, Gemini CLI no longer serves Login-with-Google users on Gemini Code Assist for individuals or Google AI Pro and Ultra (since June 18, 2026; Google points them to Antigravity CLI). It remains available with paid Gemini API or Agent Platform keys and Code Assist Standard or Enterprise, which stopped new sales on October 9, 2026 and runs until each contract ends.

Gemini Log Sources Compared

Source	What it records	Gaps
Gemini CLI OpenTelemetry	`gemini_cli.tool_call` (`function_name`, `function_args`, `decision`, MCP server), `gemini_cli.user_prompt`, `gemini_cli.file_operation`, `gemini_cli.config`, API requests; `session.id` on every event and `user.email` when the user is authenticated	Off by default; prompts included by default once on
Local session files	Prompts, responses and all tool executions, in `~/.gemini/tmp/<project_hash>/chats/`	On each laptop; 30-day default retention
Code Assist Cloud Logging	Prompts, responses and metadata with a `user_id` label, under IAM control	Google’s page describes it as limited to IDE interactions but shows CLI client examples; confirm Gemini CLI coverage on your project

Enterprise Telemetry Settings

Put it in the system settings file (/etc/gemini-cli/settings.json, /Library/Application Support/GeminiCli/settings.json or C:\ProgramData\gemini-cli\settings.json), which overrides user and project settings. Gemini’s enterprise guide says to set logPrompts to false in an enterprise setting.

{
  "telemetry": {
    "enabled": true,
    "target": "local",
    "otlpEndpoint": "https://otel-collector.example.com:4317",
    "logPrompts": false
  }
}

Where Failproof Fits

Gemini CLI is not one of the twelve harnesses Failproof hooks, and failproofai otel enable does not support it. Failproof’s docs show Gemini CLI telemetry configured manually to send through an authenticated collector of your own to Failproof Cloud; check that its events arrive before relying on it. Enforcement before a tool runs is not available for Gemini CLI; use Gemini’s own policy engine and admin controls for that. Antigravity CLI, which Google names as the successor for consumer users, is one of the twelve harnesses Failproof hooks.

FAQ

Does Gemini CLI log prompts?

Only if telemetry is enabled, and then by default: logPrompts defaults to true. Set it to false in system settings.

Can I attribute Gemini CLI activity to a user?

Yes. Telemetry events carry user.email when the user is authenticated, plus session.id.

Does Failproof block Gemini CLI tool calls?

No. Gemini CLI is not a supported Failproof harness. Use Gemini’s admin policy engine for enforcement.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.