Choosing a compiler

The compiler runs once per task, plus follow-up messages that could change authority. It never runs on the per-tool-call path. Whichever you choose, the same deterministic hardening applies, so the compiler can only make the policy narrower than your words for consequential actions.

	OpenRouter (default)	Hermes model	Offline rules
Setting	provider: openrouter	provider: hermes	provider: rules
Extra key	OPENROUTER_API_KEY	none	none
Network	one or more requests per compilation (retry or JSON-mode fallback); later authority-changing messages compile again	through Hermes’ own model client when compilation is needed	none
Understands nuance (“delete duplicates”, “reply to the thread”)	good	depends on your model	keywords only
Consequential grants	evidence-bound	evidence-bound	only sends to explicitly written addresses; other consequential actions → approval
Best for	most users	no extra account	air-gapped, privacy-critical, CI

What leaves your machine

With openrouter and hermes, your instruction text (after quoted and pasted material is stripped) and the tool catalogue (tool names and their capabilities) are sent to the model. Nothing else is sent: no tool output, no files, no history.

With rules, nothing leaves your machine.

Picking an OpenRouter model

The default is anthropic/claude-haiku-4.5. In the alpha test setup it timed out, while openai/gpt-4.1-mini compiled the same test promptly; latency and availability depend on your provider account. Set another OpenRouter model that can produce JSON with:

echo 'AGENTSFENCE_COMPILER_MODEL=anthropic/claude-sonnet-5' >> ~/.hermes/.env

A stronger model mostly improves utility: fewer unnecessary approval prompts. It doesn’t change safety, because hardening doesn’t trust the model.

Using another OpenAI-compatible endpoint

AGENTSFENCE_COMPILER_BASE_URL=http://localhost:11434/v1
AGENTSFENCE_COMPILER_MODEL=qwen3:14b
OPENROUTER_API_KEY=unused

When compilation fails

Missing key, timeout, invalid JSON after one retry, or an empty request all produce the same result: a read-only fallback policy, with your explicit prohibitions still applied, and a policy_compiled audit event marked fell_back: true.