Hermes Agent Permissions: A Step-by-Step Setup for Small Business Owners

Hermes Agent permissions decide what your AI agent can do on its own and what it has to ask you about first. For a small business, that means one config file controls which risky commands pause for a yes, which ones are refused outright, who on your team can approve, and what happens overnight when nobody is watching. Here’s how to set it up, one step at a time, straight from the Hermes docs.

What Hermes Agent permissions cover

Before Hermes runs any shell command, it checks it against a list of dangerous patterns: recursive deletes, wiping database tables, changing system files, stopping services, piping a download into a shell and more. A match goes to the approval layer. The Hermes security docs describe this as human-in-the-loop for destructive operations.

One thing to know early: if your agent runs inside Docker or a cloud sandbox, Hermes skips this check because the container is treated as the boundary. Everything below applies when the agent works on a real computer or server.

Step 1: Choose your approval mode

Open your settings with hermes config edit and find the approvals block. There are three modes.

• smart (the default) — a second model rates each flagged command. Low-risk ones run, clearly dangerous ones are refused, and anything unclear comes to you.
• manual — every flagged command waits for a person.
• off — no checks at all. The docs say to keep this for trusted, isolated environments.

For most small businesses, smart is the right starting point. Pick manual for a computer that holds client files you can’t afford to lose.

approvals:
  mode: smart
  timeout: 300

Step 2: Write a short list of commands that are never allowed

Add the commands your business never wants the agent to run. These are glob patterns, and each one must be in quotes:

approvals:
  deny:
    - "git push --force*"
    - "dd if=* of=/dev/*"

Deny rules are checked before YOLO mode or mode: off, so they still block matching commands if someone later switches approvals off. They take effect as soon as you save. Below them, Hermes keeps a built-in blocklist for the most destructive commands, such as wiping the whole disk, with no override.

Keep in mind the docs call deny rules a command policy, not a sandbox, so use them for clear “never do this” rules.

Step 3: Decide who can approve in your team chat

If your team talks to Hermes in Slack, Telegram or another chat, anyone admitted to that chat can answer an approval prompt by default. Change that with one line:

approvals:
  approvers: []

From then on, approval rights sit with the requester, the chat’s admins and the user IDs you add. Others see a short note and the prompt stays open. In the chat, people answer with yes or no, or with /approve and /deny from the slash command list.

To stop regular staff running setup commands, add an admin list per platform with allow_admin_from. The messaging docs explain that admins run every slash command, while regular users chat normally and run only the commands you allow. Each person can type /whoami to check their tier.

Step 4: Keep night jobs and automations safe

Scheduled jobs run with nobody watching, so Hermes gives them their own settings. All three default to deny:

• Scheduled jobs: cron_mode
• Single hermes chat -q commands: single_query_mode
• Webhooks and the API server: unattended_mode

Under deny, a risky command is simply blocked and the agent finds another way. If one job really needs a flagged command, allowlist just that command’s rule key. Allowlisted rule keys still run under deny, so the job works and nothing else gets through.

Step 5: Cut down on prompts without lowering your guard

Too many prompts teach people to click yes without reading. Two tools help.

• House rules for the reviewer. Write a few plain-English lines under approvals.smart_policy, as the configuration docs show, such as always asking about anything under /etc.
• An allowlist built from history. Run hermes approvals suggest after a few weeks. It proposes entries from commands your team actually approved, never proposes destructive types like recursive deletes, and changes nothing until you run it with --apply.

If you later remove an allowlist entry, restart Hermes. A running session keeps what it loaded at the start.

Step 6: Add per-tool tiers if you need them

The built-in settings are about shell commands and chat roles. If you want rules per tool, look at permission-tiers, a community plugin by imperator-clawdius that joined the catalog in the 15 November 2026 canary. It is not an official Nous Research plugin, and it’s at version 0.1.0.

hermes plugins install imperator-clawdius/hermes-permission-tiers
hermes plugins enable permission-tiers

You set allow, ask or block per tool name. With no rules, terminal and MCP tools ask and everything else works as normal. Its README says it logs every tool call locally, makes no network calls and never auto-approves.

What to avoid

• YOLO mode on business machines. --yolo, /yolo and HERMES_YOLO_MODE skip every approval prompt. Keep them for disposable test setups.
• Leaving approvers open in a group chat. Anyone admitted can say yes.
• Assuming Docker prompts you. Container backends skip the check.
• Forgetting skills. Turn on skills.write_approval if you want to review skills the agent writes for itself (skills docs).

My verdict

Start with smart mode, add three or four deny rules, set an empty approver list in every team chat and leave night jobs on deny. That covers most small businesses on day one. After a month, run the suggest command and tidy your allowlist. Bring in permission-tiers later, on a single machine, if a per-tool rule or a log of every call would help. Done in that order, you get Hermes Agent permissions that protect your business without slowing your team down.

About Julian Goldie

I’m Julian Goldie — founder of Goldie Agency and the AI Profit Boardroom. I test new AI agents almost every day for 432K+ YouTube subscribers and run Hermes, OpenClaw, OpenCode, Claude and Codex side by side in my own Agent OS. Claim your free strategy session or join the AI Profit Boardroom.

Want another angle? Read the AI Profit Boardroom guide to Hermes Agent permissions.

FAQ: hermes agent permissions

What are Hermes Agent permissions?

They are the settings that decide what Hermes can do without asking: the approval mode, deny rules, the allowlist, who can approve in chats, and how scheduled jobs behave.

What approval mode should a small business use?

Smart, the default, suits most. Use manual on a computer with client files you can’t afford to lose. Keep off for isolated test setups only.

How do I stop staff approving each other’s requests?

Set approvals.approvers to an empty list. Then only the person who asked, chat admins and anyone you list can answer.

Will an overnight job get stuck on a prompt?

No. cron_mode defaults to deny, so the risky command is blocked and the agent finds another route instead of waiting.

Can YOLO mode run anything at all?

No. It skips approval prompts, but your deny rules and the built-in blocklist still refuse matching commands.

Is the permission-tiers plugin official?

No. A community developer, imperator-clawdius, publishes it. The Hermes catalog lists it at version 0.1.0.

Related reading

• Hermes Agent Sandbox
• Hermes Agent SSH
• Hermes Agent Docker

Last updated November 2026. This page is a living guide to hermes agent permissions — the facts here move fast and it is updated as they do.