permission-tiers

hermes-permission-tiers

Tiered tool permissions for Hermes Agent, enforced by the host. Assign
allow / ask / block tiers to tool-name patterns; the plugin's
pre_tool_call hook enforces them on every tool call, and post_tool_call
keeps a local audit ledger. This is the long-requested per-tool permission
levels feature (hermes-agent #527)
implemented as a plugin — no core patching, only public hooks.

hermes plugins install imperator-clawdius/hermes-permission-tiers
hermes plugins enable permission-tiers

What it does

• Tiers, not instructions. A rule like {"pattern": "terminal*", "tier": "ask"}
  escalates every shell command to Hermes' approval gate before execution —
  something a prompt can't guarantee. block vetoes the call entirely.
• Audit ledger. Every call is recorded (tool, session, disposition,
  duration) in SQLite under the plugin's data directory, inspectable with
  permission_tiers_report.
• Self-service config. permission_tiers_set adds/updates/removes rules;
  rules also live in plain tiers.json you can edit by hand.
• Safe defaults. With no config: shell + MCP tools ask, everything else
  keeps Hermes' existing behaviour. Hook errors fail open; unattended runs
  fail closed on ask escalations; the plugin never auto-approves anything.

Tools provided

• permission_tiers_report — active rules, ledger summary, config path
• permission_tiers_set — add / update / remove a rule (only when you ask)

Disclosures (rule 13)

• No network calls. No third-party services.
• Reads/writes only its own plugin data directory (tiers.json) and SQLite
  ledger under the Hermes plugin-data root; nothing outside it.
• No stored credentials; no shell spawning; no background processes.

License

MIT.

README from the reviewed commit f5f6183; it updates when the author re-pins.