# Command approvals: decide what the agent may run unattended

> Control how Hermes handles dangerous shell commands with smart, manual or off approval modes, deny patterns and a hardline blocklist.

Canonical: https://hermeswatcher.com/tools/approvals-security  
Kind: Capability · Security & permissions  
Last reviewed: Oct 20, 2026  
Basis: Explained from the official Hermes Agent docs and repository (Nous Research). Steps follow the linked official sources.

## What it is for

Because Hermes can run shell commands, it checks each one against a list of dangerous patterns, such as recursive deletes or dropping database tables, before running it. The approvals.mode setting decides what happens next. Smart mode, the default, has an auxiliary model approve low-risk commands and deny clearly dangerous ones, escalating unclear cases to you. Manual mode asks every time, and off skips checks, the same as --yolo. Separate settings decide how cron jobs, one-shot queries and API sessions behave when nobody is there to answer. A hardline blocklist of catastrophic commands stays active even in YOLO mode.

## What you need

- A Hermes install; settings live under approvals in ~/.hermes/config.yaml
- For stronger isolation, a container terminal backend such as docker

## Setting it up

1. Set approvals.mode to smart, manual or off in ~/.hermes/config.yaml
2. Add quoted glob patterns to approvals.deny to block specific commands even in YOLO mode
3. Review approvals.cron_mode, single_query_mode and unattended_mode (each defaults to deny) before running automations

## How to check it works

- Run `hermes approvals suggest` for a read-only dry run of allowlist suggestions from your approval history
- Run `hermes doctor` for security advisories
- Watch for the YOLO banner and status-bar indicator when bypass mode is active

## Limits

- Deny rules are a command policy, not a sandbox; aliases, scripts and variable expansion can get around them
- Dangerous-command checks are skipped on container backends such as docker and modal, which are treated as the boundary
- Unanswered prompts time out and are denied (default 300 seconds) and cannot be reopened

## Related workflows

- [Know whether an automation actually worked](https://hermeswatcher.com/workflows/reliable-recurring-automation.md)

## Sources

- [Hermes Agent docs: Security](https://hermes-agent.nousresearch.com/docs/user-guide/security)

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt