Google Antigravity Sidecars and Tool Execution Policies: Securing Multi-Agent Workspaces

Google Antigravity tool execution policies define the security boundaries, sidecar capabilities, and terminal execution sandboxes that govern autonomous multi-agent coding sessions. By configuring explicit tool enablement flags (EnableWriteTools, EnableMCPTools, EnableSubagentTools) and workspace isolation modes (branch, share, inherit), engineering teams prevent unconstrained agent execution, stop credential leaks, and enforce strict execution boundaries across shared repositories.

What Are Google Antigravity Tool Execution Policies and Sidecar Scopes?

Google Antigravity tool execution policies are declarative capability boundaries that govern which operations an AI agent or sidecar subagent can invoke during a task. Defined through subagent specifications and workspace settings, these policies explicitly grant or restrict terminal execution (run_command), filesystem modification (write_file, edit_file), external Model Context Protocol (MCP specification) server integration, and recursive subagent spawning. Without explicit execution policies, autonomous multi-agent workflows risk cascading execution loops, unintended file deletions, and unvetted shell execution.

In their official agent architecture documentation, Google AI engineering emphasizes structured operational bounds: "Agents operate with bounded autonomy by scoping tool execution to declared interfaces and enforcing explicit user confirmation for state-mutating actions." In Google Antigravity, this principle is implemented at the runtime level. When a coordinator agent launches a helper agent using invoke_subagent or defines a specialized role via define_subagent, the runtime isolates the agent's capabilities according to three primary boolean flags:

• EnableWriteTools: Controls whether the agent can invoke write_file, edit_file, and run_command. When set to false, the sidecar is strictly read-only, limited to inspecting codebase structure with read_file and searching project history.
• EnableMCPTools: Dictates whether the agent has access to third-party MCP servers connected to the environment, such as external databases, cloud deployment APIs, or issue trackers. Disabling this flag isolates the agent from external network services.
• EnableSubagentTools: Determines whether the agent can define and spawn its own child agents. Restricting this permission ensures that hierarchical task delegation remains shallow, preventing runaway agent swarms and unbounded token consumption.

Developers managing cross-agent workflows often find that permission policies configured for one tool fail to translate to others. To understand how Antigravity's security model compares with Anthropic's terminal agent, review our companion guide to Claude Code tool permissions and execution safeguards.

How Do Antigravity Sidecar Modes (Inherit, Branch, Share) Sandbox Filesystem Mutations?

Google Antigravity provides three distinct workspace isolation modes (inherit, branch, and share) to isolate filesystem mutations when delegating work to sidecar agents. While inherit operates directly within the parent working directory for fast read-only audits, branch generates an isolated repository clone and share attaches an independent Git worktree sharing underlying .git storage. This three-tier isolation architecture guarantees that speculative code refactors, dependency upgrades, and test executions cannot corrupt the primary workspace until explicitly validated and merged.

Understanding the mechanical trade-offs between these three workspace modes is essential for architecting stable multi-agent workflows:

1. Inherit Mode (Default): The sidecar executes directly in the parent agent's active working directory. This mode incurs 0ms setup latency and zero additional disk consumption, making it ideal for read-only codebase researchers, syntax linters, and verification checkers. However, if granted write permissions, any file created or modified by the sidecar immediately alters the developer's working tree, risking conflicts with uncommitted local work.
2. Share Mode (Git Worktree): Antigravity provisions an isolated working directory backed by Git's native worktree mechanism. Because all worktrees share the primary repository's .git object store, provisioning takes under 400ms and consumes 0 bytes of duplicate repository history. Authors, refactoring subagents, and automated builders run concurrently on distinct feature branches without file-locking contention.
3. Branch Mode (Isolated Clone): The runtime creates an entirely decoupled clone of the repository in an isolated sandbox directory. This mode provides total isolation from the parent's Git index, protecting against destructive operations such as forced branch resets or untracked file purges. When the sidecar task finishes, Antigravity can discard or merge the sandbox cleanly.

To explore how workspace isolation intersects with terminal execution across different platforms, see our comprehensive architectural comparison of Google Antigravity vs OpenAI Codex CLI.

Tool Execution Policies Matrix: Permission Capabilities Across Antigravity Agent Roles

Structuring multi-agent swarms requires assigning specific tool execution policies to distinct agent roles. Restricting sidecars to the minimum necessary capabilities prevents privilege escalation and accidental file corruption.

The Sprawl Moment: The Unrestricted Sidecar in a Shared Monorepo

You launch a complex multi-agent refactoring run in Google Antigravity to modernize legacy database access layers across four microservices in your company's primary repository. In the orchestration brief, you instruct an autonomous subagent to inspect schema models and generate type-safe query interfaces. Because the subagent inherited default write permissions without an isolated workspace boundary, it starts executing raw shell scripts directly in the repository root. It runs an unpinned migration command that overwrites local database seeds, alters shared configuration files, and triggers a cascaded compilation failure across three adjacent microservice packages. When you switch back to your terminal to run a routine test, your working directory is cluttered with detached intermediate artifacts, and your uncommitted stashes are corrupted—forcing you to spend two hours manually restoring your Git index and unpicking sidecar mutations.

How Do You Configure Terminal Command Sandboxing and run_command Boundaries?

Terminal command sandboxing in Google Antigravity is configured by constraining the run_command interface through synchronous timeout thresholds (WaitMsBeforeAsync), daemon process flags, and execution whitelists. Rather than permitting unrestricted subshell execution, production Antigravity configurations bound commands to a maximum synchronous wait window (from 500ms to 10,000ms) before background task detachment and enforce non-interactive terminal flags.

When authoring custom Antigravity subagents, you define these security constraints directly in the subagent definition schema:

// Defining a hardened, read-only research sidecar in Google Antigravity
define_subagent({
  Name: "codebase-researcher",
  Description: "Inspects repository structure, symbols, and test files without write permissions.",
  EnableWriteTools: false,    // Blocks write_file, edit_file, and run_command
  EnableMCPTools: false,      // Disables external third-party API tools
  EnableSubagentTools: false, // Prevents recursive agent spawning
  SystemPrompt: "You are a read-only codebase researcher. Identify code locations and report findings."
});

// Invoking an isolated author sidecar in a dedicated Git worktree
invoke_subagent({
  TypeName: "feature-author",
  Role: "Database Migration Specialist",
  Workspace: "share",         // Isolated Git worktree with 0-byte duplicate storage
  Model: "inherit",
  Prompt: "Refactor user authentication schema in src/auth. Verify tests with 'npm test'."
});

When an authorized sidecar does execute shell commands, the runtime wraps execution in an isolated zsh session. By setting WaitMsBeforeAsync: 5000, long-running processes (such as Docker container builds or webpack compilation) automatically transition into manageable background tasks instead of blocking agent decision loops. Developers can inspect, deliver input to, or terminate background processes using the manage_task tool, ensuring full visibility into running terminal jobs.

To explore how rule boundaries and scoping mechanisms operate across Antigravity workspaces, read our guide on configuring custom workspace skills in Google Antigravity and our breakdown of Google Antigravity rules and agent triggers.

Mitigating Privilege Escalation: Preventing Prompt Injection Across Subagent Delegation

Privilege escalation in multi-agent swarms occurs when an untrusted input—such as an unvetted GitHub issue, third-party pull request, or web documentation snippet—injects instructions that coerce a privileged sidecar into executing unauthorized shell commands. Google Antigravity mitigates this attack surface by enforcing strict role separation between untrusted reader subagents and privileged execution workers. By sandboxing external web exploration and repository research into zero-write subagents, the primary coordinator agent verifies intermediate facts before delegating file modifications or running terminal scripts.

Engineering teams enforce four critical security safeguards when designing multi-agent delegation pipelines:

• Strict Input Untrusting: Treat all subagent outputs as untrusted data. When a research subagent retrieves data from external URLs or untrusted files, the coordinator must sanitize the text and never execute code snippets returned in subagent responses without validation.
• Host-Verified Telemetry: Antigravity emits system-generated audit events (such as host facts and background process status) that verify actual actions performed by subagents. Coordinators evaluate verified system facts rather than relying on the subagent's self-reported claims.
• Deterministic Sandboxing: Sensitive credentials, environment variables (e.g., .env), and secret tokens must never be mounted into shared subagent workspaces. For engineering teams handling sensitive codebases, see our guide to preventing credential leaks in developer AI prompt libraries.
• Precedence Standardization: When working across polyglot repositories containing Cursor rules, Claude skills, and Antigravity guidelines, resolve conflicting instructions by establishing a strict hierarchy. Consult our enterprise reference on multi-agent rules architecture to standardize rule precedence across your stack.

How Prompttly Centralizes Hardened Agent Skills and Tool Execution Boundaries Across Teams

Prompttly centralizes hardened agent skills and tool execution boundaries by providing a unified, version-controlled library that translates across Google Antigravity, Anthropic Claude Code, Cursor, and OpenAI Codex.

Prompttly is a skill manager for AI agents — one library for your skills and prompts that syncs into Claude Code, Codex, ChatGPT, and Claude and is one hotkey away on your Mac, so your setup follows you across every machine, repo, and tool.

In modern engineering teams, developers rarely work inside a single AI tool. One engineer runs Google Antigravity for multi-agent subagent swarms, another uses Claude Code for fast terminal prototyping, and a third relies on Cursor for interactive IDE refactoring. When security policies, custom instructions, and execution boundaries are managed manually inside local config files (like ~/.gemini/antigravity/, ~/.claude/settings.json, or .cursor/rules), teams inevitably face configuration drift and permission sprawl.

Prompttly solves this sprawl by serving as the central system of record for your AI skills and rules:

• Automated Multi-Agent Sync: Prompttly automatically projects versioned skills into native formats across your filesystem—writing SKILL.md bundles to ~/.claude/skills, tool schemas to ~/.codex/skills, and workspace configurations for Google Antigravity.
• Global Mac Hotkey Palette: Pressing a global hotkey on macOS opens your entire prompt and skill library in under 200ms, letting you insert parameterized prompts directly into any terminal, editor, or browser interface without copying and pasting.
• Version History and Audit Trails: Every prompt and execution policy is tracked with full version history, allowing engineering teams to audit breaking changes, review prompt updates, and roll back unintended modifications across workstations.

To author hardened custom instructions and test agent skills before deploying them across your team, use our free Custom Instructions Generator and free Claude Skill Creator. For organizations establishing team-wide prompt governance, explore our guide to the best AI prompt managers for teams.

Frequently Asked Questions About Antigravity Tool Execution Policies

Next Steps and Multi-Agent Architecture Resources

Explore our complete library of technical guides, multi-agent architecture references, and coding assistant tutorials on the Prompttly Resources Hub:

• Google Antigravity vs Codex CLI: Compare workspace sandboxing, subagent orchestration, and skill formats between Google Antigravity and OpenAI Codex.
• Claude Code Tool Permissions & Safeguards: Configure terminal auto-approvals, subagent execution scopes, and settings.json boundaries in Claude Code.
• Custom Workspace Skills in Google Antigravity: Master workspace-scoped vs global Antigravity skills, subagent isolation, and team synchronization.
• Google Antigravity Rules & Agent Triggers: Learn how to configure workspace rules, trigger guidelines, and context files in Antigravity.
• Multi-Agent Rules Architecture: Standardize instruction precedence across AGENTS.md, .cursor/rules, and Claude Skills in production.
• Best AI Prompt Managers for Teams: Compare enterprise evaluation platforms, prompt access control, and team skill synchronization.
• Free Custom Instructions Generator: Generate clean, sanitized agent instructions with structured frontmatter and zero credential exposure.
• Prompttly for Mac: Download the native macOS app for instant sub-200ms hotkey prompt access and two-way agent filesystem sync.