Hermes Roadmap: A Permissions and Security Policy Model for AI

If an AI could do absolutely anything it wanted, you might as well leave your house keys hanging by the front door. The Hermes roadmap is currently building a set of smart, graded locks for every single capability the agent has.

What this direction is: a “multi-level access control system” for your AI

Imagine you hire a supremely capable live-in butler. He can cook your meals and run errands (everyday tasks), but he can also sign contracts on your behalf (high-risk actions), and he can watch your house while you’re on vacation (unattended operation). The question becomes: how much of your home do you let him into? Does he have free rein to rifle through your study and read your private files? Or do you only let him use the kitchen while you’re home?

That’s exactly the problem Hermes is solving with its new permission and security model. This isn’t a simple on/off switch. Instead, it’s like the security system in a modern office tower—segmented by zone, by time of day, and by clearance level. The rules for when the AI can act, which rooms it can enter, and whether it needs your explicit nod are all defined in advance. The goal is to move from “trust the AI completely” to “manage the AI deliberately.”

What the official plan includes: every item is a security lock

1. Every key needs your nod—but only once
Before the AI uses a tool that touches something sensitive (say, reading a file), it will pop up a prompt: “I’d like to read this file—okay?” If you say yes, Hermes will remember that decision for similar cases in the future, so it won’t keep pestering you. It’s like the butler asking for the study key the first time. After you grant it, you can set a standing rule: “He’s allowed in the study during working hours.”

2. Four contexts, four levels of strictness
The same butler behaves differently depending on the situation. When you’re home and typing commands yourself (interactive mode), he can be more relaxed. When you’re gone and he’s executing a pre-set list of tasks (unattended mode), he sticks to the script. When he’s handling your scheduled chores (cron jobs) or greeting visitors at the door (gateway mode), the rules are the strictest of all. The acceptance criteria make this explicit: unattended and gateway executions must run under stricter policies than your own interactive CLI sessions. No exceptions.

3. Filesystem and network allowlists
You can define exactly which doors the AI’s keycard opens. For example: “The AI can only read files inside the /work folder, and it can only visit websites under your company’s domain.” Anything outside that list is physically inaccessible. This is like giving the butler a keycard that only works on specific doors—he can’t wander into the garage or the neighbor’s apartment even if he wanted to.

4. Secret access is fully logged
When the AI uses a password, an API key, or any other credential, every single use gets recorded in the log. If something goes wrong later, you can trace back: who used which key, at what time, for what purpose. It’s the equivalent of installing a security camera on your safe. The issue explicitly calls for auditing secret access and exposing those events in logs and diagnostics, so operators can review the trail.

5. Dangerous commands require a “second confirmation”
Actions like deleting files or formatting a disk are tagged as “high-risk.” The AI cannot perform these on its own judgment—it must get your explicit, separate confirmation before proceeding. Think of it as the butler wanting to throw away your old clothes. He can’t just do it because he thinks they’re worn out; he has to bring each item to you and ask, “May I discard this?” The classification of dangerous commands is a core part of the roadmap.

6. Plugins must come with a “user manual”
Going forward, every plugin will be required to declare its permissions upfront—just like a mobile app listing “access to storage, camera, and contacts” before you install it. If a plugin doesn’t state what it needs, it won’t install at all. This forces transparency and prevents a plugin from secretly grabbing more access than it should.

7. Four pre-set policy profiles
You don’t have to build your own rules from scratch. Hermes will offer four templates: Personal (relaxed), Team (collaborative), Production (strict), and Restricted (extremely strict). You can pick one directly or customize it. For example, Personal mode might let the AI freely read your documents, while Production mode requires an approval record for every single operation. This makes the system usable by a solo hobbyist and a large enterprise operations team alike.

What it means for you: from “trusting AI” to “managing AI”

In the past, using an AI tool was often an all-or-nothing bet: you either trusted it completely or you didn’t use it at all. After this roadmap item lands, you get two things you didn’t have before: explainability and auditability.

Explainability means that before the AI acts, you can see what it plans to do and why. The acceptance criteria require that tool and plugin access be explainable before execution—no more black-box surprises. Auditability means that every security decision (grants, denials, secret accesses, high-risk confirmations) is logged in a way that operators can review. If something goes wrong, you can trace the exact chain of decisions and hold the right party accountable.

It’s a shift from hiring an unvetted babysitter to employing a licensed, monitored, rule-bound housekeeping agency. The butler can still cook, clean, and manage your schedule—but he operates within a defined perimeter. He can’t open the safe, access the server room, or delete the family photos without you knowing, approving, and having a record of it.

The end state is simple: you can let the AI handle the tedious, repetitive, and complex work that drains your energy, while keeping the risk locked in a cage. A good butler isn’t one who never makes mistakes—it’s one whose every step you can see, and whose keys you can take back at any moment. That’s the future Hermes is building, one graded lock at a time.