What not to automate
The most expensive mistake with an agent is not technical — it is automating the wrong work. There are categories where, however well the agent performs, automating is the wrong decision:
- Irreversible operations — production deploys, deleting data, payments, signing contracts
- Decisions with legal or regulatory consequences — credit decisions, hiring, disciplinary action
- Outbound communication — a message to a customer, a public post, official correspondence
- Calculations that must be exactly right — accounting, regulatory reporting
- Operations that widen access — granting permissions, creating keys, adding users
This does not mean "the agent must never touch these". The right pattern is the prepare / execute split: the agent prepares the draft, a human approves and executes.
- instead of deploying → have it write the release notes and a risk list
- instead of messaging a customer → have it draft the reply
- instead of deleting from a database → have it produce the list of rows that would be deleted
- instead of granting access → have it collect who asked for what and why it is needed
The split is also practical: preparation eats 80% of the time, approval the other 20%.
| Question | If the answer is yes | Conclusion |
|---|---|---|
| Can a wrong result be undone? | Yes | Safe to automate |
| Does a wrong result leave the building (customer, public, regulator)? | Yes | Requires human approval |
| Is checking the result cheaper than doing the work? | Yes | Let the agent prepare and a human check |
| Is the result checkable at all? | No | Do not automate |
The threat model in the docs points the same way: the primary focus is the "honest-but-wrong agent" — not malice, but a wrong command issued with the right intention. That is the correct mental model for automation decisions: the agent does not mean you harm, it just sometimes gets it wrong — quickly, and at scale.
Practice. Add two columns to the role matrix from the previous topic: "reversible?" and "does the result leave the building?". Then re-assess every row. Done means: you have downgraded at least one row from "fully automatic" to "the agent prepares, a human approves".
📚 Sources and documentation
- Security: the threat modelofficialhermes-agent.nousresearch.com
The "honest-but-wrong agent" and the deny rules.
- Scheduled tasksofficialhermes-agent.nousresearch.com
- Tipsofficialhermes-agent.nousresearch.com