This seems to be working now. gemini_in_workspace_apps is part of the API pattern rules for allowed applications.