Google's Gemini CLI shipped a feature last week that tells you to slow down and think — then unthrottles everything the moment you agree with yourself. Plan mode, enabled by default for all Gemini CLI users as of March 11, 2026(https://developers.googleblog.com/plan-mode-now-available-in-gemin...
image from GPT Image 1.5
Google's Gemini CLI shipped Plan mode as a human-in-the-loop safeguard, but approving a plan automatically switches to YOLO mode (auto-approves everything) rather than the more cautious Default mode, making the safety check a one-time gate rather than continuous oversight. During planning, the system restricts tools to read-only operations and routes to high-reasoning Pro models, with an ask_user feature for targeted clarifications mid-plan. Version 0.35.2 also introduced SandboxManager using bubblewrap and seccomp for kernel-level process containment during tool execution.
Google's Gemini CLI shipped a feature last week that tells you to slow down and think — then unthrottles everything the moment you agree with yourself.
Plan mode, enabled by default for all Gemini CLI users as of March 11, 2026, is Google's attempt to add a human-in-the-loop checkpoint to an AI coding agent. You ask it to build something, it lays out the steps, you review, you approve. The agent then executes. Read-only tools only during planning. A policy engine enforces it via a plan.toml configuration file.
The irony is built into the architecture. When you approve a plan, Gemini CLI automatically switches from Plan mode to YOLO mode — the setting that auto-approves every subsequent tool call — rather than the standard Default mode that would pause at each action. Google's logic: one human decision covers all the execution steps that follow. The plan is the approval.
"The CLI can execute the implementation steps automatically without hanging on interactive tool approvals," the documentation explains. In practice, this means Gemini CLI goes from asking permission before touching your filesystem to touching everything without asking, the instant you say yes to a plan. The safeguard only exists before consent. After, it's full throttle.
The policy engine during Plan mode permits a curated set of read-only tools: file reads, directory listing, glob, grep, web search, codebase investigation, CLI help, and read-only MCP tools. Writing is limited to .md files in a plans/ directory. The ask_user tool lets the agent pause mid-plan to pose clarifying questions — "where's that config file?" or "which API version should I target?" — before committing to a strategy. This is the feature's best idea: targeted clarification rather than guesswork. During planning, Gemini CLI routes to high-reasoning Pro models like Gemini 3.1 Pro for architectural decisions, then switches to Flash or standard models during execution.
Three approval modes exist in total: Default (pauses at each tool call), auto_edit (auto-approves edit tools only), and Plan (read-only). YOLO mode — which auto-approves everything — can only be enabled via command line with --yolo or --approval-mode=yolo. It was not designed to be reached through normal UI interaction. The Plan mode exit path reaches it anyway.
The timing is notable. Version 0.35.2, released March 26, 2026, also introduced a SandboxManager with Linux-native sandboxing using bubblewrap and seccomp to isolate tool execution. That's real infrastructure: process containment at the kernel level. Separately, the Conductor extension for Gemini CLI — enabling Context-Driven Development with explicit Context, Spec and Plan, and Implement phases — shows where the pattern is heading: agents that negotiate scope before touching code.
The blog post was authored by Jerop Kipruto, a staff software engineer, Jack Wotherspoon, a developer advocate, and Dmitry Lyalin, group product manager — three names that suggest a team that actually uses this internally, not just a marketing announcement.
The broader question this raises: what does "human oversight" mean when the oversight window is the size of a plan approval? If the agent has already reasoned its way to a correct plan, and the human's job is just to say yes or no, the assumption is that the reasoning is sound. But reasoning models are good at showing work, not at being right. The plan looks rigorous. The execution is still an agent with a filesystem and network access, doing exactly what it said it would do — fast.
Our read: the irony is real but so is the use case. Plan mode is genuinely useful for catching scope drift and forcing the agent to externalize its thinking before acting. The YOLO switch is a design compromise, not a bug — it's removing friction that would make the feature unusable in practice. The real test is whether developers actually review plans carefully, or whether "approve" becomes the AI coding equivalent of clicking "I agree" on a terms of service page. That behavioral question — not the architecture — will determine whether this is oversight or theater.
Story entered the newsroom
Research completed — 12 sources registered. Plan mode is now enabled by default for all Gemini CLI users (March 11 2026). It is a read-only planning mode with a restricted tool set: filesystem r
Draft (660 words)
Approved for publication
Headline selected: Google's Plan Mode Asks First, Then Goes YOLO
Published (660 words)
Get the best frontier systems analysis delivered weekly. No spam, no fluff.
Agentics · 3h 12m ago · 5 min read
Agentics · 3h 37m ago · 4 min read
