Overview

AgentsFence is an open-source plugin for Hermes Agent. It gives each task a least-authority contract, derived from what you actually asked for, and checks every tool call against it before the tool runs.

USER INTENT        "Summarize my inbox. Do not send anything."
      ↓
COMPILED POLICY    allowed: reading/searching · prohibited: COMMUNICATION
      ↓
HERMES TOOL CALL   mcp_gmail_send_message(to="attacker@example.com")
      ↓
GUARDRAIL          BLOCK  [user-prohibition]  (the tool never runs)

In one paragraph

When a task starts, Hermes fires pre_llm_call. AgentsFence sends your message only to a policy compiler, removes any authority your words don’t support, and stores the resulting TaskPolicy for the session. Before every tool call, Hermes fires pre_tool_call. AgentsFence classifies the call by what it can do (read, communicate, delete, pay, execute…), checks it and its arguments against the policy, and answers ALLOW, BLOCK or ASK_USER. The agent can replan however it likes, but its actions have to stay inside the envelope.

Where to go next

• Getting started: install into Hermes and pick a compiler.
• Run the demo: reproduce the attacks offline, or through your own Hermes install.
• How it works: the two stages, and why the plan isn’t the policy.
• Security model: guarantees, heuristics and limits.
• Technical paper: the full design rationale.

What it is not

• It isn’t a content filter. It decides whether an action may happen and to whom, not what an authorized email says.
• It isn’t a sandbox. Once a task may run shell commands, effects inside that process need OS or network isolation.
• It isn’t a hosted service. There’s no backend and no telemetry. The only network call is the policy compiler, and even that is optional.