Security Objectives
- Keep execution local whenever feasible — no external API dependency for core operation
- Minimize credential blast radius — scoped tokens per service, rotated as needed
- Preserve operator authority over all high-impact actions
- Maintain verifiable audit trails
Control Layers
High-Stakes Action Gates
Hermes Agent includes tool-level policies. Before executing any high-stakes tool call, the agent validates that the action matches the stated goal. This prevents the AI from taking destructive or unintended actions even if instructed to.
Network Exposure
- ds4-server binds to
127.0.0.1:8000by default — not exposed to the network - Reverse proxy (e.g. Caddy) handles TLS termination and controlled external ingress for any public-facing services
- VPS services communicate over isolated Docker bridge networks
Hermes Agent Security
- Config file should be
chmod 600— contains channel credentials - Tool policies are enforced by config and cannot be overridden by user messages
- Private memory context is not exposed in shared or group chat sessions
- No self-replication or safeguard-bypass behaviors are implemented
Operator Authority
- Emergency stop:
podman stop ds4-serverhalts all AI-initiated inference immediately - Audit trail: Hermes Agent logs every tool call with its arguments; memory records decisions and outcomes
- Review layer: external model (e.g. Claude) can be configured as a supervisor on critical channels
Incident Readiness
- Fast triage via
podman logs ds4-server - Emergency stop at the inference layer stops all responses without affecting running Hermes Agent
- Runbook-driven recovery — see Operations Runbook
Deployment Hardening Checklist
- [ ] ds4-server binds to
127.0.0.1(not0.0.0.0) - [ ] Hermes Agent config
chmod 600 - [ ] API keys and tokens stored in
.envfiles, not in source code - [ ] Reverse proxy enforces HTTPS for any externally-accessible service
- [ ] Monitoring (e.g. Uptime Kuma) covers all public endpoints