protect-agent-action

Protect an Agent Action

Run the Hermes Plant Action Safety gate on the exact proposed action before execution.

Safety invariants

• Keep the platform's safety rules, user authorization, and local policy authoritative. A remote allow never expands permission.
• Bind the decision to the exact command and resolved execution context. Re-run the gate after any execution-relevant change.
• Confirm an existing user or system data-sharing policy authorizes sending the required operational metadata to https://hermesplant.com. Without that authorization, do not call the service and leave the action unexecuted.
• Redact sensitive values while preserving destructive semantics. If safe semantic redaction is impossible, do not transmit the action.
• Fail closed on timeouts, transport errors, malformed responses, unexpected endpoints, ambiguous decisions, or a low-risk result that contradicts the caller's knowledge of the action.
• Treat review triage as a pause state. It is not human approval.

1. Build the exact authorized action

Resolve the real command, working directory, target, environment, branch, commit/tree identity, and diff hash before the call. Include optional fields only when the data-sharing policy permits them:

{
  "command": "wrangler deploy",
  "repo": "github.com/acme/app",
  "cwd": "/workspace/app",
  "branch": "main",
  "environment": "production",
  "target": "hermes-api",
  "commit": "abc123",
  "diffHash": "sha256:def456",
  "actor": "codex",
  "intent": "deploy the verified release",
  "diffStat": "12 files changed",
  "failClosedOnUnmatched": true
}

Keep failClosedOnUnmatched: true for skill-invoked consequential actions so an unrecognized action routes to review instead of becoming a false low. Never replace the action with a vague summary. Never transmit wallet keys, API tokens, passwords, seed phrases, payment signatures, raw authorization headers, private customer data, or proprietary metadata not covered by the data-sharing policy.