How-To Series · Module 9: Locking It Down
Secure Hermes on a Work Machine
Run Hermes safely on the machine you live on.
After this videoYour agent runs with a safe posture on a shared or work machine
Hermes ships secure by default, with defense in depth covering command approval, file write safety, and credential handling. Dangerous commands require approval, approval prompts fail closed, and a hardline blocklist refuses the worst commands. To tighten on a shared or work machine, switch approvals to manual, add deny rules, sandbox file writes with HERMES_WRITE_SAFE_ROOT, and move command execution off the host with a Docker or SSH terminal backend. Enable checkpoints to snapshot your project before destructive operations and undo with /rollback.
About these resources. This episode explains the security posture for running Hermes on a personal or work machine. The Sources block names the Hermes docs page that backs every claim.
New words here · Plain English
one sentence each · full glossaryApproval modeHow Hermes decides whether to run a flagged command. Smart auto-approves low risk, manual always prompts.
Deny ruleA glob pattern that blocks a matching command unconditionally, even under yolo.
Terminal backendWhere Hermes runs commands: local, Docker, or SSH. Docker and SSH keep execution off the host.
CheckpointA snapshot Hermes takes before a destructive operation, so /rollback can undo it.
Sources · What this video distills
1 docs page · every command below traces to one of themCommands shown · Copy and paste
each shows the source doc it came from/rollback/rollback diff 3/rollback 3