FAQ

Does AgentsFence send my data anywhere?

Only policy compilation. With openrouter or hermes, your instruction text (with quoted and pasted content stripped) and the tool catalogue are sent to the model at task start and when a later message could change authority. Invalid output may be retried; OpenRouter can also retry with a different JSON mode. With rules, nothing leaves your machine. There’s no AgentsFence backend, no telemetry and no analytics.

Will it slow Hermes down?

Compilation adds one model call at the start of a task, typically a second or two with the default Haiku model. Each tool-call check is plain Python. On a laptop the decision takes about 0.03 ms, or about 0.3 ms including writing the policy state and the audit line to disk.

Won’t it ask me to approve everything?

No. Reads are always in scope, and anything you asked for runs without a prompt. You’ll see prompts only when the agent tries something consequential you didn’t mention. If you see too many, a stronger compiler model or an explicit tool mapping usually helps.

Can’t the agent just use a different tool to do the same thing?

Enforcement is by capability and risk class, not tool name. If sending is out of scope, then send_message, mcp_gmail_send_message, curl -d … and scp are all out of scope. Arguments count too: browser_console with a JavaScript expression is code execution, a multi-file patch is checked file by file, and sort -o isn’t a read. The block message tells the model not to look for workarounds.

The remaining gap is code you’ve authorized to run: what a script does inside the process is invisible to AgentsFence. Use a container backend for tasks that run code.

What if the compiler model is itself prompt-injected, or just wrong?

It never sees content the agent reads, only your message. Its output is hardened: consequential permissions need a verbatim quote from you, recipients must appear in your words, and your “don’ts” override it. In tests with a deliberately compromised compiler that grants everything, attacks still fail. Legitimate actions fall back to asking.

Can I edit the policy mid-task?

Yes, by talking to the agent. “Actually, also email it to john@example.com” is compiled and merged, and newer explicit instructions win. The agent itself can’t edit the policy.

Does it work with subagents?

Yes. delegate_task children are bound to the parent’s policy and share its counters, and their goal text, which the parent model wrote, is never compiled.

What about --yolo?

Hermes auto-approves ASK_USER in yolo mode. BLOCK still applies. Set evaluation.strict_yolo: true to turn ASK_USER into BLOCK in that mode. Under the read-only fallback policy (compiler unavailable), questions always become blocks in yolo mode.

I use other Hermes plugins. Can they override AgentsFence?

Hermes acts on the first block or approve any plugin returns. AgentsFence moves itself to the front when it loads and again at every turn, so another plugin’s approve can’t hide its block, including on the first tool call. This is tested against real Hermes, with an approve-everything plugin loaded before AgentsFence and Hermes in --yolo. agentsfence doctor lists other plugins that decide tool calls. If you also want AgentsFence’s questions never to hide their blocks, set evaluation.plugin_conflicts: strict.

Does it work in group chats?

Yes, with one caveat. Only the person who started a task can widen its policy; anyone’s “don’t …” restricts it. This relies on the platform reporting who sent each message. Keep Hermes’ group_sessions_per_user: true so each participant gets their own session.

Does it work with agents other than Hermes?

The compiler, evaluator and policy model don’t depend on Hermes. Only plugin.py is specific to Hermes. Ports to other agent runtimes are welcome.

Where’s the audit log?

~/.hermes/agentsfence/audit.jsonl, readable with agentsfence audit or /fence audit. Message bodies and other free text are stored as a length plus a hash, never in plain text.