Hermes Agent permissions are the rules that decide what the agent may do without asking you: an approval mode for risky shell commands, a fixed blocklist nothing can override, your own deny list, a saved allowlist, and settings for who may answer an approval in a shared chat.
📺 Watch: How to Make Hermes Agent 10X More Powerful!
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside
This guide walks through each layer in the order Hermes applies it, using the official Hermes security docs, and then covers permission-tiers, a community plugin that joined the catalog in the 15 November 2026 canary release and adds allow, ask and block levels per tool.
Julian Goldie shares his own agent setups, step-by-step trainings and weekly coaching calls inside the AI Profit Boardroom. If you would rather plan your agent's guardrails with someone first, book a free AI strategy session.
The three approval modes
Before Hermes runs a shell command, it checks the command against a curated list of dangerous patterns. A match needs your approval.
How that approval works is set by one key, approvals.mode, in ~/.hermes/config.yaml. It takes three values.
- smart is the default. An auxiliary model scores the risk. Low-risk commands are approved for that one command, clearly dangerous ones are denied, and unclear ones come to you.
- manual asks you about every flagged command. In the terminal you get a dialog; in a messaging chat you get a pending approval request.
- off switches all approval checks off. The docs say to use it only in trusted places such as CI pipelines and containers.
The flagged list covers recursive deletes, world-writable chmod, disk formatting and copying, SQL DROP and TRUNCATE, writes into system config, stopping services, force-killing processes, piping a download into a shell, and stopping or removing Docker containers and volumes.
How to answer an approval prompt
In the CLI, a flagged command shows four choices: once, session, always and deny. Deny is the default, so pressing Enter blocks it.
Once allows that single run. Session allows the pattern until the session ends. Always writes it to a permanent allowlist called command_allowlist in config.yaml.
On Telegram, Slack, Discord and the other messaging platforms, reply yes, approve, ok or go to allow it, or no, deny or cancel to block it. The slash commands /approve, /approve session, /approve always and /deny do the same job.
Hermes never asks you to approve a command it can't show you in full. If it can't display the whole command, the card offers Deny only.
If you don't answer within the timeout, which defaults to 300 seconds, the command is denied. An expired prompt can't be reopened, so just ask the agent again in a new message.
📺 Watch: Hermes3D Is INSANE: AI Agents Now Have a 3D Office
YOLO mode and what it still won't skip
YOLO mode skips every dangerous-command prompt. You turn it on with the --yolo flag, with the /yolo toggle inside a session, or with the HERMES_YOLO_MODE environment variable.
The /yolo toggle covers only the chat you typed it in, and it is saved with that session. On a messaging platform, /new and /resume bring approvals back.
While it is on, Hermes shows a red banner at session start and a YOLO marker in the status bar, so you always know.
Three prompts still appear under YOLO: an MCP server's declared spend limit, questions an MCP server asks you for input, and payment-card fill prompts from the credential vault.
The blocklist and your own deny rules
Below YOLO sits the hardline blocklist. It refuses a small set of catastrophic commands, such as wiping the filesystem root, a fork bomb or zeroing a physical disk, whatever mode you are in. There is no override flag.
Above that floor you can add your own: approvals.deny is a list of glob patterns that block matching commands before YOLO or mode off is even checked.
The docs show patterns such as git push --force followed by a wildcard. Quote every pattern in YAML, and note that changes apply at once without a restart.
The docs are clear on one limit: deny rules are a shell-command policy, not an operating-system sandbox. For real containment, use an isolated backend. Our Hermes Agent sandbox guide covers those backends, and on Docker, Modal, Daytona and Vercel Sandbox the dangerous-command check is skipped because the container is the boundary.
📺 Watch: Hermes AI Agents Just Went Portable
Unattended runs: cron, one-shot and webhooks
Some sessions have nobody watching. Hermes gives each of them its own setting, and all three default to deny.
| Setting | Applies to | Default | What deny does |
|---|---|---|---|
| cron_mode | Scheduled cron jobs | deny | Blocks the flagged command; the agent must find another way |
| single_query_mode | One-shot hermes chat -q runs | deny | Same, because no one is there to answer |
| unattended_mode | Webhook, msgraph_webhook and API server sessions | deny | Blocks at once instead of waiting out the timeout |
| approvals.mode | Every interactive session | smart | Not a deny switch: smart, manual or off |
Each one can be set to approve instead. Commands whose rule key sits in command_allowlist still run under deny, which is how you let one known job through.
Want help deciding which of your scheduled jobs should run hands-free? Book a free AI strategy session and bring your job list.
Who can approve in a shared chat
By default, any member admitted to a chat can answer a pending approval, whoever started it. In a team group that is rarely what you want.
Set approvals.approvers to an empty list and only the person who asked, the chat's admins and any user IDs you list can answer. Anyone else gets a note that only the requester can answer, and the prompt stays open.
Hermes also splits each messaging platform into two tiers per scope. Admins, set with allow_admin_from, can run every slash command. Regular users can chat normally but only run the commands you list in user_allowed_commands, plus /help and /whoami.
Today those tiers gate slash commands only. The messaging docs say tool access may be gated in the future. Type /whoami to see your own tier.
Hermes Agent permissions per tool: the permission-tiers plugin
The core settings above are about shell commands and chat roles. They don't let you say "this tool always asks" or "that tool never runs". The permission-tiers plugin fills that gap.
It is a community plugin by imperator-clawdius, version 0.1.0, not an official Nous Research plugin. Its catalog entry landed in the 15 November 2026 canary release.
- Three tiers. You assign allow, ask or block to tool-name patterns. Block vetoes the call, ask sends it to the normal approval gate, allow lets it pass. The first matching rule wins.
- Safe defaults. With no config, terminal tools and MCP tools ask, and everything else behaves as usual.
- Audit ledger. Every tool call is logged to a local SQLite file with the session, outcome and duration.
- Two tools. permission_tiers_report shows rules and the ledger; permission_tiers_set adds, changes or removes a rule.
- Local only. The README says it makes no network calls and stores no credentials. Unattended runs fail closed on ask, and it never auto-approves.
Install it with hermes plugins install imperator-clawdius/hermes-permission-tiers, then enable it with hermes plugins enable permission-tiers. It needs Hermes 0.23 or later.
My verdict on Hermes permissions
Leave approvals.mode on smart, add a short deny list for the few commands you never want run, and set approvers to an empty list in any shared chat. That covers most setups.
Use hermes approvals suggest after a few weeks. It reads your past approvals and proposes allowlist entries, never proposes destructive classes, and changes nothing until you pass --apply.
Add permission-tiers only if you need per-tool rules or an audit trail, and treat it as early community code.
Julian covers agent guardrails with members inside the AI Profit Boardroom. His Agent OS guide shows how agents, tools and approvals fit together, and Goldie Bench scores the models you might trust with the work. For a plan built around your business, book a free AI strategy session.
FAQ
What is the default approval mode in Hermes?
Smart. An auxiliary model approves low-risk flagged commands, denies clearly dangerous ones and sends unclear ones to you.
Does YOLO mode turn off every safety check?
No. It skips approval prompts, but the hardline blocklist and your approvals.deny rules still block matching commands, and spend limits still ask.
How do I stop teammates approving my commands in a group chat?
Set approvals.approvers to an empty list. Then only you, the chat's admins and any IDs you add can answer your approvals.
What happens to a flagged command in a cron job?
With the default cron_mode of deny, the command is blocked and the agent has to find another path. Allowlisted rule keys still run.
Is permission-tiers made by Nous Research?
No. It is a community plugin by imperator-clawdius, listed in the Hermes catalog. It adds allow, ask and block levels per tool name.
How do I clean up my permanent allowlist?
Open it with hermes config edit and remove the patterns. Restart Hermes afterwards, because a running session keeps patterns it already loaded.
Pick your mode, write a short deny list, lock down approvers, and you have Hermes Agent permissions that match how you actually work.
