Markdown Edit

Google Antigravity

Google Antigravity is an AI-first software development platform and agentic coding environment comprising a desktop application, IDE extensions, and the agy command-line interface.

Permissions & Security Architecture

Antigravity operates a unified, fine-grained permissions engine formatted as action(target) (such as read_url(*), command(git), or write_file(src/)). Operations are evaluated across three priority tiers: Deny > Ask > Allow.

Configuration Scopes

When managing permissions (via the /permissions interactive TUI in agy or the settings panel), permissions are split into three distinct scopes:

Project Scope: Rules that apply exclusively when operating within a specific project/repository.
Shared Scope: Rules shared across all Antigravity surfaces on the machine (IDE, Desktop App, and CLI).
Global Scope: Rules applied across all sessions for the agy CLI.

Storage Locations on Disk

Scope	Location on Disk	Description
Project Permissions	`~/.gemini/config/projects/<project-uuid>.json`	Project-scoped permission grants and trusted settings, keyed to the local repository directory path.
Global CLI Settings	`~/.gemini/antigravity-cli/settings.json`	User-level global settings and global permission grants.
Shared Antigravity Config	`~/.gemini/config/` / `~/.gemini/antigravity/`	Cross-surface preferences and shared state.

Repository-Level vs. Local Security Isolation

Project permissions cannot be defined or committed directly within the Git repository folder itself (such as a checked-in .antigravity/permissions.json).

This design is a deliberate security boundary:

Preventing Repo-Level Privilege Escalation: If repositories could declare their own permission bypasses or auto-approval rules in checked-in files, cloning an untrusted or malicious third-party repository could lead to arbitrary command execution, network exfiltration, or local file compromises without user consent.
Separation of Capabilities and Authorization: Collaborative assets such as custom agent instructions, rules, workflows, and tools are shared via the repository (in AGENTS.md, GEMINI.md, and .agents/), while actual permission authorizations remain strictly under the developer's local user-level control.