# Security & permissions

> Approvals, allowlists, sandboxes and safe defaults for an agent that can act.

Canonical: https://hermeswatcher.com/topics/security

An agent that can run commands and send messages needs deliberate limits. Start with the smallest permission scope that completes the task, prefer sandboxed backends for untrusted work, and make approvals visible.

## Guides, tools and workflows

- [Deployment: separate the agent host from its execution sandbox](https://hermeswatcher.com/tools/deployment.md): Understand the difference between running Hermes in a container and using a container only for terminal commands.
- [Checkpoints and rollback: undo the agent's file changes](https://hermeswatcher.com/tools/checkpoints-rollback.md): Snapshot your working directory before Hermes edits files, then preview or restore earlier states with /rollback.
- [Command approvals: decide what the agent may run unattended](https://hermeswatcher.com/tools/approvals-security.md): Control how Hermes handles dangerous shell commands with smart, manual or off approval modes, deny patterns and a hardline blocklist.
- [Terminal backends: choose where the agent's commands run](https://hermeswatcher.com/tools/terminal-backends.md): Run the agent's shell commands locally, in Docker, on a remote host over SSH, or in cloud sandboxes like Modal, Daytona and Vercel Sandbox.
- [Hermes Agent permissions for real workflows](https://hermeswatcher.com/learn/permissions-for-real-workflows.md): Define access by account, operation and destination so useful autonomy does not depend on ambiguous instructions.
- [Hermes Agent task denied when scheduled](https://hermeswatcher.com/troubleshoot/unattended-task-permission-denied.md): Find the blocked operation and execution policy instead of disabling approvals for every unattended task.
- [Hermes Agent security: approvals, allowlists, sandboxing](https://hermeswatcher.com/learn/security-model-approvals-and-sandboxing.md): How Hermes's layered defences fit together, from dangerous-command approval and the hardline blocklist to file-write guards, container backends and gateway authorisation, and what each layer does not protect against.
- [How to update Hermes Agent safely](https://hermeswatcher.com/learn/updating-hermes-safely.md): What hermes update actually does, how to preview and back up before updating, how release channels work, and how to recover if an update goes wrong.

## Questions

- [Is my data sent anywhere? Does Hermes collect telemetry?](https://hermeswatcher.com/faq#is-my-data-sent-anywhere)
- [Will Hermes run dangerous commands without asking?](https://hermeswatcher.com/faq#dangerous-command-approval)
- [What is YOLO mode?](https://hermeswatcher.com/faq#yolo-mode)
- [How do I stop being asked to approve the same command?](https://hermeswatcher.com/faq#command-allowlist)
- [Can I sandbox the agent so it can't touch my machine?](https://hermeswatcher.com/faq#sandbox-terminal)
- [Can I let Hermes run freely but forbid specific commands?](https://hermeswatcher.com/faq#block-commands-always)
- [Does Hermes protect against prompt injection in project files?](https://hermeswatcher.com/faq#prompt-injection-context-files)
- [Can I keep API keys in 1Password or Bitwarden instead of the .env file?](https://hermeswatcher.com/faq#secrets-manager)
- [Can I undo file changes the agent made?](https://hermeswatcher.com/faq#undo-agent-file-changes)
- [How can I tell if a third-party skill or plugin is safe before installing it?](https://hermeswatcher.com/faq#is-plugin-skill-safe)
- [How much access does Hermes (and Hermes Desktop) have to my computer, and can I restrict it?](https://hermeswatcher.com/faq#how-much-access-desktop)
- [How do I let family members or coworkers use my agent while keeping their data separate?](https://hermeswatcher.com/faq#share-agent-with-family)
- [What happens to my data when I use models through Nous Portal?](https://hermeswatcher.com/faq#portal-data-privacy)
- [How does Hermes handle passwords, logins and payment details?](https://hermeswatcher.com/faq#passwords-and-payments)
- [If I approve a plan, is Hermes bound to it, and will it ask before going beyond it?](https://hermeswatcher.com/faq#plans-and-approvals)
- [Are third-party “Hermes” apps affiliated with Nous Research?](https://hermeswatcher.com/faq#unofficial-hermes-apps)
- [How do I connect work tools like Outlook, Jira or an ERP without over-granting access?](https://hermeswatcher.com/faq#work-tools-least-access)
- [If I connect several accounts (say work and home Gmail), which one does Hermes use?](https://hermeswatcher.com/faq#multiple-connector-accounts)

All answers: https://hermeswatcher.com/faq.md

---

HermesWatcher is an independent guide. It is not affiliated with or endorsed by Nous Research. The [official Hermes Agent documentation](https://hermes-agent.nousresearch.com/docs) and [repository](https://github.com/NousResearch/hermes-agent) from Nous Research are the authority; each page here lists the official sources it was written from. If this site and the official docs disagree, trust the official docs. Index for agents: https://hermeswatcher.com/llms.txt