Hermes Agent v0.19: Secret Delivery, Profile Routing, and Session Security
A practical English review of Hermes Agent v0.19, focused on secret delivery, deny rules, profile routing, delivery records, transcript handling, and safe session export.
Hermes Agent v0.19 is best understood as a security and operations release, not as a collection of isolated switches. Secret delivery, profile routing, deny rules, delivery records, subagent transcripts, and session export all answer the same question: can an agent do useful work without turning credentials and context into an uncontrolled data trail?
The right evaluation starts with boundaries. Keep secrets outside prompts and transcripts, give each profile only the providers and tools it needs, and make every delivery destination explicit. A feature is production-ready only when an operator can inspect its behavior, explain a failure, and roll back without guessing which state was shared.
Secret delivery and profile isolation
SecretSource should be treated as an input boundary rather than a convenience wrapper. Test missing values, malformed values, rotation, and accidental logging. A token should arrive at the component that needs it without becoming part of a message, debug record, exported session, or copied environment snapshot. Redaction is useful, but preventing the secret from entering the artifact is safer.
Profiles provide a practical trust partition. Keep personal conversations, automation, experiments, and production work in separate profiles with separate home directories, skills, memory, sessions, and provider configuration. Verify the routing rule with a harmless request before granting access to real accounts. If two profiles can unexpectedly read the same state, the boundary is conceptual rather than real.
Deny rules and action review
Deny rules are most useful when they are specific, testable, and visible to the operator. Test both direct calls and indirect routes through skills or subagents. A blocked operation should produce an understandable result without leaking the protected argument. Review exceptions as temporary policy objects with an owner and expiry, not as permanent edits made under incident pressure.
For high-impact actions, keep a human checkpoint between planning and execution. The agent may prepare a command, draft a message, or identify a file, while the operator confirms scope, destination, and expected side effects. This is slower than unconditional autonomy, but it creates an evidence trail that can survive a handoff.
Delivery records and transcripts
A delivery ledger should answer what was sent, where it went, when it happened, and whether the destination acknowledged it. It should not become a second place where raw secrets or private payloads are retained forever. Store identifiers and safe summaries where possible, apply retention limits, and test duplicate delivery and retry behavior.
Subagent transcripts deserve the same care. They can contain tool arguments, snippets of private files, and intermediate assumptions even when the final answer looks harmless. Decide which transcripts are retained, who may read them, and how redaction is tested. Do not treat an internal label such as “subagent” as a security boundary.
Session export, rollback, and verification
Before exporting a session, inspect what it contains: messages, tool results, profile identity, paths, metadata, and attachments. Export only to an approved destination and verify that the receiving profile has the intended permissions. A restore test should prove both that useful context returns and that excluded secrets do not.
For rollback, preserve a known-good profile configuration, rotate exposed credentials, revoke unnecessary routes, and invalidate sessions whose trust boundary is uncertain. Then run a small verification workflow: inspect configuration, execute a read-only tool call, confirm the audit record, and check that delivery and transcript policies still hold.
Conclusion
Hermes Agent v0.19 becomes easier to trust when its security model is operated as a set of explicit boundaries: secrets are scoped, profiles are isolated, deny rules are testable, deliveries are attributable, transcripts are governed, and exports are reversible. Those checks matter more than a release headline because they determine whether an agent can remain useful after the first successful demo.