Generated capability
Skills written by the agent are code that nobody reviewed at design time. They need the same provenance, review and rollback path as anything else that reaches production.
Hermes Agent · Runtime engineering & security · Switzerland
It writes its own skills. It must not write its own limits.
Hermes is an open-source agent runtime from Nous Research built around a learning loop: it creates skills from experience, refines them in use and carries knowledge between sessions. Numezis deploys that loop inside explicit trust boundaries, so the capability compounds and the authority does not.
Primary intentSELF-IMPROVING AUTOMATION
Control surfaceSKILLS · MEMORY · TOOLS
OutcomeGOVERNED AGENT SERVICE
The enterprise question
The value is the learning loop. So is the risk.
A conventional agent does what its harness allows today. Hermes changes what it can do tomorrow: it writes skills, keeps memory and improves its own procedures. That is exactly why teams adopt it — and why the review question shifts from “what can this agent do” to “what can this agent become, and who signs off on the change”.
Persistent state
Knowledge that survives the session also carries whatever was wrong, sensitive or injected into it. Memory is a data store with a retention policy, not a convenience.
Untrusted instructions
Documents, pages and tool output shape behaviour, and in a learning loop a single successful injection can be written down and reused.
Process authority
Hermes runs the loop inside the process you launch. Whatever that process can reach — files, keys, networks — is the agent’s real permission set.
Architecture
Put the boundary outside the loop the agent can edit.
Hermes is invoked rather than resident: the agent loop and tool dispatch live in the process you start. That makes the host the security perimeter. We design the runtime so that skills, memory and tools are governed artefacts, and so that the sandbox holding them is not reachable from inside the loop.
Business workflow
Named users, allowed tasks, approval gates and an accountable owner for every outcome the agent produces.
Skills & memory
Skill provenance, review before promotion, versioning, retention rules and a revocation path for learned behaviour.
Process sandbox
Container or OS isolation, network allowlist, filesystem restrictions and mediated credential access around the invocation.
Inference & infrastructure
Explicit model route, compute boundary, identity, telemetry and lifecycle ownership for the whole runtime.
Control system
Defense in depth, with evidence at every boundary.
Identity & tenancy
Separate hosts, OS identities or gateways wherever trust boundaries differ; no routing identifier is ever treated as authorization.
Network policy
Default-restricted egress, explicit destinations, DNS and SSRF controls, and exceptions that are reviewed rather than accumulated.
Filesystem isolation
Minimum readable and writable paths, read-only runtime surfaces, and protected configuration and credential stores.
Credentials
Dedicated identities, scoped and rotated secrets, mediated access, and no primary-account credentials inside the agent state.
Tools & approvals
Allowlisted capabilities, human confirmation for consequential actions, and a clean separation between reasoning and execution.
Evidence & response
Action logs, configuration baselines, policy tests, anomaly review, patch ownership and a defined shutdown path.
Numezis delivery
From experiment to a controlled agent service.
01
Threat model
Map users, channels, tools, data, credentials and credible abuse paths before anything is deployed.
TRUST BOUNDARY MAP02
Isolate
Choose the host and sandbox model, define network and filesystem policy, and separate tenants.
RUNTIME BASELINE03
Integrate
Connect only approved systems, with scoped identities, mediated secrets and explicit action contracts.
INTEGRATION RECORD04
Verify
Test prompt injection, policy bypass, credential access, dangerous tools and recovery behaviour.
SECURITY EVIDENCE05
Operate
Instrument activity, cost and quality; own upgrades, incidents, exceptions and periodic access reviews.
OPERATING CONTROLFAQ
Hermes in the enterprise: the questions that matter.
How is Hermes different from a coding agent like Claude Code or Codex?
Coding agents are invoked to perform a task inside a repository and are judged on that task. Hermes is built around persistence: it accumulates skills and memory so the same class of work gets cheaper over time. That makes it attractive for recurring operational automation, and it makes skill governance the central control.
Can Hermes run without sending data outside Switzerland?
The runtime is open source and runs where you put it. Data residency is then determined by the inference route and by any tool that reaches an external service — which is why we treat the model route and the tool allowlist as explicit architecture decisions, not defaults.
How do you stop the agent from acquiring capability nobody approved?
Generated skills are treated as code: provenance, review before promotion to the trusted set, versioning and a revocation path. The sandbox limits what any skill can reach regardless of what it contains, and consequential actions keep a human gate.
Is Hermes production-ready for a regulated organisation?
It can be, inside a narrow and well-instrumented scope. We advise starting with one recurring workflow, an explicit data boundary and a shutdown path, then widening only against measured quality, cost and incident evidence.
Important boundary
A learning agent is a change process, not a tool install.
The question a Swiss risk function will ask is not whether Hermes performed well in a demo, but who reviews the skills it wrote last month, what its memory retains, and how a bad learned behaviour is detected and removed. We build the answer into the deployment rather than around it.
Hermes Agent is third-party technology published by Nous Research. Numezis provides independent architecture, engineering and security expertise around it; no partnership, certification or endorsement is implied without a formal announcement.