Hermes Agent permissions: contain access and review actions

Hermes Agent can read files and call tools, so the useful setup question is how much access a task actually needs. The project documents command approvals, file-write protections, container isolation and authorization for messaging users; configure the smallest practical boundary before giving it real work.

Use a disposable working copy

Start in a separate repository clone or branch with no production credentials. Keep unrelated personal files outside the working directory. Before a task begins, state which files the agent may inspect and what output it should produce. A clean working copy makes unexpected edits easier to spot and reverse.

Enable only the tools the task needs

Review the toolsets available in the current Hermes setup. A read-only research task does not need terminal writes or messaging access; a code edit may need file tools but not a gateway connected to other people. Disable unused capabilities and add them later only when the work requires them.

Understand approvals and isolation

The official security guide describes approval modes for dangerous commands and several isolation layers. Read the current settings before selecting a mode; a permissive setting can allow actions that are hard to undo. For higher-risk work, consider the documented Docker or remote terminal backend and verify what files, network access and credentials remain visible inside it.

Protect tokens and integrations

Store provider credentials using the supported secret mechanism, and keep tokens out of prompts, logs and repository files. If using a messaging gateway, restrict who can contact it and test authorization with an account you control. An integration increases the number of places where private context can travel.

Review every consequential result

Inspect the complete diff, command output and any generated memory or skill files. Re-run appropriate checks yourself and revert changes that exceed the task. Approval prompts and containers reduce risk but do not guarantee that an agent’s interpretation or output is correct; keep a human review before merging, publishing or changing production systems.