Guardrails before it touches anything real
“I want approval gates and sandboxing so my agent can't do something destructive on its own”
Almost every guardrail story starts the same way — the agent did something confidently wrong, fast, and the person went looking for a brake. Layer these from outside in: a sandbox that limits the blast radius regardless of what the agent believes, a runtime harness for the credentials it can see, then policy that decides which actions require a human. The trust-boundary fork is the alternative to bolting the middle layers on, and it is a real fork, so treat it as an either/or rather than an addition. Adversarial review is narrower — it protects the code you ship, not the system the agent runs on.
Real posts from the Hermes community, mirrored from Nous Research's user stories corpus.
My Hermes agent used to start executing the moment I hit enter. I'd describe a vague idea and it would immediately start writing files, calling tools, making changes I hadn't fully thought through yet. So I built converse mode. One plugin, two commands. The…
Running Hermes on Discord in public channels, every outbound reply goes live instantly. For multi-user servers, persona testing, compliance, kid-facing bots — I want a human-in-the-loop gate.
The genuine differentiator is the multi-platform messaging gateway — runs across Telegram, Discord, Slack, WhatsApp, Signal, WeChat, iMessage, and CLI simultaneously. Five defensive security patterns including OSV malware checking for MCP packages and…
I've put together a skill to protect against some of the common LLM / AI threats and some of my recommended security policies that are being used to good effect on other AI agent tools.
I'm using Hermes. The same applies to all agents, don't give it free reign over all your stuff. Run it within a sandbox. https://github.com/nousresearch/hermes-agent
- A fork with built-in trust boundaries and a bolted-on harness solve overlapping problems. Pick one architecture rather than stacking both.
- Guardrails only bind the paths they know about. An agent with shell access routes around policy that lives above the shell.