Command approvals: decide what the agent may run unattended

What Command approvals is for

Because Hermes can run shell commands, it checks each one against a list of dangerous patterns, such as recursive deletes or dropping database tables, before running it. The approvals.mode setting decides what happens next. Smart mode, the default, has an auxiliary model approve low-risk commands and deny clearly dangerous ones, escalating unclear cases to you. Manual mode asks every time, and off skips checks, the same as --yolo. Separate settings decide how cron jobs, one-shot queries and API sessions behave when nobody is there to answer. A hardline blocklist of catastrophic commands stays active even in YOLO mode.

What you need

• A Hermes install; settings live under approvals in ~/.hermes/config.yaml
• For stronger isolation, a container terminal backend such as docker

Set it up

1. 1

   Set approvals.mode to smart, manual or off in ~/.hermes/config.yaml

2. 2

   Add quoted glob patterns to approvals.deny to block specific commands even in YOLO mode

3. 3

   Review approvals.cron_mode, single_query_mode and unattended_mode (each defaults to deny) before running automations

Check it works

• Run hermes approvals suggest for a read-only dry run of allowlist suggestions from your approval history
• Run hermes doctor for security advisories
• Watch for the YOLO banner and status-bar indicator when bypass mode is active

Limits and failure points

• Deny rules are a command policy, not a sandbox; aliases, scripts and variable expansion can get around them
• Dangerous-command checks are skipped on container backends such as docker and modal, which are treated as the boundary
• Unanswered prompts time out and are denied (default 300 seconds) and cannot be reopened

Spotted something wrong or out of date? Tell us on X at @HermesWatcher↗ (opens in a new tab) and we will fix it.