The Swif Hermes Access Policy controls what the Hermes agent, Nous Research's open-source autonomous AI agent, can do on your devices. You can set:

To find where Hermes is installed and how it's set up, use the Swif Agent Inventory Policy.

Important: Only the fields you fill in are managed, and your lists replace the user's. Fields you leave empty aren't managed, so the user's own Hermes settings stay in place. When you set a list, such as Denied Commands, it replaces the user's own list. It isn't added to it.

Swif applies the policy every minute, so a setting a user changes is put back within a minute.

Hermes profiles. Each Hermes profile (started with hermes -p name) has its own settings. Swif applies the policy to every user's profiles, as well as their main settings.

Sandbox Backend is the exception. Hermes reads it only from each user's own settings, so Swif writes it there on every platform, even with Linux Lock on, and puts it back if it's changed.

smart is also Hermes's own default. Assigning the policy with this default keeps Hermes's behavior, and stops users from changing it. Choose manual to make Hermes stricter.

Writing patterns:

Denied Commands is your hard limit. Hermes checks it before anything else, so a denied command is blocked whatever the approval mode, and in every Sandbox Backend, including containers.

Denied Commands covers terminal commands only. It doesn't match code that Hermes runs with its code execution tool. To stop that too, add code_execution to Disabled Toolsets.

Removes toolsets from Hermes, so the model can't use them. For example:

Toolset names use lowercase letters, digits, -, and _. See Hermes's tools and toolsets documentation for the full list.

Where Hermes runs shell commands and code:

The backend must already be set up. For example, docker needs Docker installed. If it isn't set up, Hermes refuses to run commands.

Container backends skip approval prompts. With docker, singularity, modal, daytona, or vercel_sandbox, Hermes doesn't ask for approval of dangerous commands, because the container is the security boundary. Approval Mode doesn't apply there, but Denied Commands still do.

Hermes asks the user only when the guardian model is unsure, and never runs a force-push or deletes from the root folder. Users can't change the approval mode.

Hermes asks before every dangerous command, never runs those patterns, and can't run code, so the denied patterns can't be worked around with the code execution tool.

Hermes runs commands in a Docker container instead of directly on the device. Install Docker on every assigned device first. Hermes doesn't ask for approval inside the container, but it still blocks force-pushes.

Sandbox Backend is set to a backend that isn't set up on the device. For example, docker needs Docker installed. Set it up, or change the backend.

This is expected. A list you set in the policy replaces the user's own list. Add any patterns they still need to the policy. Their own list comes back if you clear the field or unassign the policy.

This is expected. On macOS, Windows, and Linux with Linux Lock off, Swif puts managed settings back within a minute.

The Sandbox Backend is docker, singularity, modal, daytona, or vercel_sandbox. Hermes doesn't ask for approval inside containers. Denied Commands still apply.

Check whether it ran as code, through Hermes's code execution tool. Denied Commands covers terminal commands only. Add code_execution to Disabled Toolsets to stop code execution.

Swif applies the policy to every profile, every minute. Wait a minute for the next check, then start the profile again.

This is expected. Singularity is Linux only.

Swif

Hermes