Profiles instead of roles

How Hermes handles access, as of v0.19.0, and which parts you add yourself.

How access works

AI answers about this build describe “an admin profile for the household lead plus restricted roles for members” inside one agent, sharing “a family vault”. Here’s what Hermes has instead:

Gateway auth is allow or deny. The check order is per-platform allow-all → DM pairing list → platform allowlists → global allowlist → global allow-all → deny. An unknown sender gets a one-time code and the owner runs hermes pairing approve <platform> <code>. One instance has no admin or restricted tiers.
Different access means different profiles. hermes profile create <name> (with --clone or --clone-from) makes a separate agent with its own config, model, credentials, toolsets, memory, skills, sessions and gateway. hermes gateway list shows them.
The family vault is a folder you create. Skills in both profiles read and write it. Hermes already protects ~/.ssh/ and .env files, and HERMES_WRITE_SAFE_ROOT limits where an agent can write.

So the build is one household profile with every tool and credential, paired with the lead, plus trimmed member profiles. Both run on one box and share the group chat and the vault.

The map

built inFamily group chatA Telegram or WhatsApp group. Both gateways support group chats. Everyone uses it, including unpaired kids.

built inMember DMsDMs to a bot work like a command line. Pairing decides who gets through.

↓ two gateways, one box ↓

built inProfile: householdAll toolsets: homeassistant, cronjob, skills, memory, browser (Portal, metered). Holds HASS_TOKEN and MCP credentials. Paired with the lead. Serves the family group.

built inProfile: sam-agentTrimmed toolsets, approvals.deny globs, docker terminal, its own allowlist (Sam only) and memory. No house credentials.

↓ both profiles’ skills read/write ↓

you buildThe family vaultA plain folder, e.g. ~/family-vault/, with groceries.md, members/ notes and house docs. Your skills keep it in shape, and HERMES_WRITE_SAFE_ROOT keeps member writes inside it.

you wireCalendar + Notion, via MCPHermes can connect any MCP server. Add a Google Calendar server and a Notion server to household only.

built inCron schedulerPlain-language jobs in ~/.hermes/cron/, delivered to any platform. Runs the 07:00, 16:00 and 21:30 jobs.

built inHome AssistantA gateway platform (WebSocket state events) plus ha_list_entities, ha_get_state, ha_list_services and ha_call_service. Full build in the smart home plan.

Three flows

Morning brief with clash resolution

The 07:00 cron prompt in the household profile tells the agent to read the calendar through MCP before writing anything. It finds the 08:25/08:30 overlap, posts one message suggesting a swap, and a person reacts. Clash checking is just part of that prompt, so if it fails you still get a brief.

Grocery consolidation

A skill in both profiles (prompt 4) appends mentions to ~/family-vault/groceries.md. The 16:00 cron cleans it up, pushes it to Notion through MCP and posts a summary. Cart loading uses browser_navigate, browser_click and browser_type on Browser Use’s cloud Chromium. It’s metered (paid Nous Portal), breaks when shop sites change, and stops before payment.

Per-person context in the group

Each profile has MEMORY.md (2,200-character cap) and USER.md (1,375 characters) in its system prompt, plus search over past sessions. Nothing in the docs covers per-sender memory in groups. So “the agent knows Dele hates coriander” comes from a note per person in the vault’s members/ folder, kept by a skill. Keep the notes short.

Security

Credentials live in one place. HASS_TOKEN, calendar and Notion credentials and Portal access go only in household’s .env. Hermes also strips env vars from child processes unless you set terminal.env_passthrough.
Docker for anything members can trigger. The docker terminal drops all capabilities, sets no-new-privileges, and caps at 256 processes and a 512 MB tmpfs. The docs call the container the security boundary. execute_code on the local backend isn’t sandboxed, so keep member profiles off it.
Approvals per profile. Set approvals.mode (smart, manual or off) and approvals.deny fnmatch globs on member profiles. The hardline blocklist (fork bombs, rm -rf /) holds even in yolo mode, but don’t lean on it.