FREE GOVERNANCE CHECK · 16 QUESTIONS
Hermes Agent Governance Readiness Check
Identify control gaps, evidence to request and suggested accountable roles for one Nous Research Hermes Agent deployment.
For managers accountable for an organisational deployment, with support from security, IT and governance owners. This check concerns Hermes Agent, not the Hermes model family.
This is a self-report. It does not inspect an installation, scan vulnerabilities, test controls or provide production, security or compliance approval.
Set the deployment context
Consider one deployment. Choose Unknown where you need IT confirmation. Do not enter credentials, personal names, customer records or confidential descriptions; this check uses fixed choices only.
Consequential actions include externally visible changes, spending or changes affecting people. Report features as disabled only when they are outside this deployment’s actual scope. Changing setup later clears earlier answers.
What to ask your IT team
Hermes Agent Governance Readiness Check
Management summary and detailed findings
ACT is one editable AI Controls Toolkit with eleven core files across eight workflow areas. It supports evidence collection and human decisions; it does not enforce controls or certify compliance. Do not email confidential results without your organisation’s authorisation. Explore ACT
How the result is determined
Methodology HERMES-GOV-1.0 uses categorical findings and counts, not a weighted risk score. The questions and priorities are Move78 governance recommendations.
- Unanswered setup items or questions prevent a final result. Unknown is a valid response, not a completed control.
- Any applicable control reported partial or absent produces Control gaps require action.
- Unknown controls or applicability, without reported gaps, produce Evidence needed before review. Unknown deployment stage, execution location or interface also requires evidence.
- Only all applicable controls reported implemented produces Controls reported; verification required.
Known gaps and unknowns remain visible together. Access restrictions, consequential actions, unattended operation, stopping and credential revocation receive review priority when unresolved. These priorities are Move78 rules about possible loss of control, not statutory tests.
When Not applicable is permitted
Only the six feature-specific questions permit Not applicable: consequential actions, scheduled/unattended execution, third-party skills, skill writes, memory writes and MCP/connectors. The corresponding setup feature must be reported disabled. All other controls are universal. Unknown applicability is an evidence finding, never an exclusion. Exclusions remain listed and must be reassessed if the deployment changes.
Answer handling and limitations
The questionnaire processes answers in page memory. It does not send them, put them in URLs or save them in browser storage. Retake or reload clears them. The page still makes ordinary requests for website assets and Google Fonts. A saved or printed result is a file you control. See the privacy policy.
A reported control is not tested effectiveness. The suggested owner roles are prompts for local accountability, not assignments. Review the evidence with the appropriate owner before relying on the controls. Do not use this check as approval for production, security or compliance.
Sources and version boundary
Source review: . Hermes Agent v0.22.2 (release commit d923a5eb487a17c0a68801bba9ef0f56c81040a8) and the rolling documentation below informed the evidence prompts. Record the installed version and effective configuration for your own deployment; this does not establish compatibility with every installation.
- Nous Research: Hermes Agent security documentation
- Nous Research: Hermes Agent configuration
- Hermes Agent v0.22.2 release
- Pinned approval implementation
Documentation and code are related sources from the same publisher, not independent security assurance. Approval and write-review behaviour depends on configuration, backend and invocation mode. The documentation’s blanket Docker approval description does not cover the pinned code’s host-access checks. Request evidence for the actual execution path rather than assuming a container or approval setting proves protection.
Page created: . Methodology version: HERMES-GOV-1.0.
Source review dates are stated in the relevant guides.