◆ Sparround

Command approval, deny rules and YOLO

The approval system is the day-to-day security layer of working with an agent. approvals.mode takes three values:

  • `smart` (the default) — an auxiliary model classifies risk: low-risk commands pass silently, high-risk ones are auto-denied, uncertain cases are shown to you
  • `manual` — it asks every time
  • `off` — no approval prompts (only for trusted CI or container environments)

Additional settings: approvals.timeout (default 300 seconds; denied if no answer), cron_mode and single_query_mode (both default to deny), and destructive_slash_confirm.

In the CLI the approval dialog offers four choices, and the default is deny:

  • once — just this time
  • session — allow that pattern for the rest of the session
  • always — written into command_allowlist (permanent)
  • deny — blocked

On messaging platforms the same flow runs through messages: the agent shows the command and you reply yes/no.

Be careful with always — it is written permanently into configuration. hermes approvals suggest mines past approvals for allowlist candidates and automatically filters out destructive classes (rm, sudo, disk writes, credential edits, pipe-to-shell, SQL DROP).

MechanismCan it be bypassed?What it is for
`approvals.mode`Yes — with `off` or YOLOThe day-to-day approval policy
`command_allowlist`You create it yourselfRepeating patterns you consider safe
`approvals.deny`No — it holds even under `--yolo` and `mode: off`Your own red lines
The hardline blocklistNo — in no mode`rm -rf /`, fork bombs, zeroing a disk and so on

YOLO mode (hermes --yolo, /yolo, HERMES_YOLO_MODE=1) switches off every approval dialog and shows a red banner. An important detail: YOLO does not bypass the hardline blocklist — rm -rf /, fork bombs, formatting the root disk and piping an untrusted URL to a shell at rootfs level stay blocked regardless. approvals.deny rules are also stronger than YOLO.

The practical conclusion: write your own red lines into approvals.deny — they survive whatever mode is active.

Practice. Add three rules for your own environment to approvals.deny (for example git push --force*, kubectl delete in the production namespace, DROP TABLE). Then deliberately ask the agent to run one. Done means: the command does not execute, and it still does not execute under --yolo.

📚 Sources and documentation