Human Validation Before Sensitive Actions

19.7. Human Validation Before Sensitive Actions — Asking a Human Before Sensitive Actions

This is the closing point of the entire chapter 19 — the final boundary of trust.

Although everything in 19.1–19.6 is about letting the agent operate automatically, continuously, and across many channels — there still needs to be a human confirmation layer before performing actions that are irreversible or high-risk. This is exactly where the mechanisms from chapter 6 (Security) meet day-to-day operations in practice.

The approval mode mechanism — the default layer

hermes config set approvals.mode manual   # always ask before dangerous commands
hermes config set approvals.mode smart    # a secondary LLM assesses risk and auto-approves the less dangerous

For operations already known to be high-risk (mass deletions, DROP TABLE, overwriting system files), Hermes stops and waits for confirmation instead of just doing it — exactly the principle described in 6.3.

Write-approval gate for self-created skills

For changes the agent makes to its own skills (10.5/20.5), you can enable a dedicated approval gate so that no new behavior takes effect immediately without human review.

Applying this in practice to the sub-sections above

• For cron jobs (19.6) that perform actions with real impact (sending emails to customers, updating a CRM, publishing posts publicly), design a draft-first step: the responsible person reviews, then it is sent — as recommended in 17.3, 17.6, and 16.4.
• For redirecting/correcting mid-task (19.5), this is also a natural opportunity for a human to intervene before the agent goes further down a risky path — corrections in progress and human validation complement each other; they are not two separate mechanisms.

Notes

• Do not turn approval off entirely (“for convenience”) just because you have grown used to using the agent daily — familiarity is exactly when you are most likely to skip confirmation on a genuinely sensitive action out of complacency.
• For sensitive actions that are not in Hermes’s built-in list of dangerous patterns (for example, financial transactions, operations on real customer data in a CRM), design your own manual confirmation step at the workflow level (draft → approve → send) instead of relying completely on the built-in approval mechanism.
• Periodically review what is currently running fully automatically (without confirmation) and decide whether it really should stay at that automation level — trust should increase deliberately and gradually, not be granted by default from the start.