I had to ask Gemini CLI to remind myself ;) but you can add this into settings.json:

{ "excludeTools": ["run_shell_command", "write_file"] }

but if you ask Gemini CLI to do this it'll guide you!