Eight progressive tiers of agent isolation from Shared Everything to fully locked production with Agent Vault. The core trade-off at each tier: convenience vs containment and security. Start at Tier 1, graduate as needs grow.
The Core Trade-Off
At each tier: convenience for containment and security. Do not over-engineer from the start. Begin at Tier 1 and graduate as your needs grow.
Tier 1: Shared Everything
One install, one profile, one channel. Same memory, same workspace, same credentials for all projects.
Use when: Starting out, learning Hermes. Learn the tool before adding complexity.
Tier 2: Per-Project Folder Structure
Each project gets its own folder with its own agents.md file. When you CD into a project folder and start Hermes, it reads only that project's agents.md.
For Telegram/Discord use: set CWD to the appropriate project folder. Nemanja's preference: run from the projects/ root with CWD set there, keeping overview of all projects while preventing cross-contamination.
Strengthen in soul.md: "Do not step outside the currently active project. Do not edit files in other project folders."
Use when: Multiple personal projects, mix of work and personal.
Tier 3: Domain Managers and Shared Specialists
Agency-style setup. Domain managers (investment manager, content manager, lead gen manager) plus shared specialists (researcher, coder, verifier).
Example: after the main agent kept polluting memory with investment details at the expense of other business memory, Nemanja created a separate "investment manager" profile with its own soul.md, memory, and instructions.
Create agents by telling your main agent: "Create a coder agent, copy all my auth providers to that profile, copy all skills." Or manually: hermes profile create coder.
Use when: Managing clients, domain-specific memory isolation needed.
Tier 4: Domain Managers and Domain Specialists
Instead of shared specialists, each domain manager gets its own specialists. An investment researcher differs from a general researcher in soul, skills, and instructions.
Do NOT copy all agents into every project: too much maintenance overhead. Only create domain-specific specialists when the role truly requires isolation from other domains.
Use when: Client work with meaningfully different domains.
Tier 5: Separate OS User
Create a non-admin user for running Hermes. OS-level separation from your main user account without requiring a separate machine.
Different SSH keys, different .hermes folder, different env files.
Always recommended when: Running Hermes on a VPS at all. Nemanja considers this always applicable regardless of other isolation choices.
Tier 6: Isolated Runtime (Docker or VM)
Docker: Dependency isolation and context leakage prevention between containers. Not strong security containment by itself.
Virtual Machine: Better security containment than Docker. If an instance is compromised, nuke the VM and the threat is isolated from your main machine.
Use when: Long-running agents; when you need isolation stronger than OS user but less than a full separate machine.
Tier 7: Separate VPS or Machine
Best for: Public-facing agents, long-running agents doing scraping or heavy tasks ("dirty tasks"), client agents, separate businesses.
Your main agent can SSH into sub-VPS instances and control them directly: "SSH into the PressWiz instance and check if the connection works." You do not manually SSH into every satellite VPS.
This is the most practical form of strong isolation that Nemanja uses regularly.
Use when: Scraping, email triage, agents that read untrusted web content, client agents, production business-critical agents.
Tier 8: Fully Locked Production + Agent Vault
All APIs separate, repos scoped, channels scoped, risky actions require approval, full logging.
Agent Vault is the "final boss" of agent isolation. It is a secrets broker, not a storage layer.
How Agent Vault works:
- Keys are NEVER present in the agent's environment
- Only a placeholder exists where the key would normally be
- On every API call, the actual key is fetched in real time from a separate broker VPS
- Even a successful prompt injection attack finds no keys to steal
This means:
- No keys on disk in .env (same as Bitwarden benefit)
- No keys in OS environment (unlike Bitwarden - this is the key difference)
- Prompt injection cannot extract keys because they are never present
Agent Vault requires 30-60 minutes to set up. Network dependency on every API call. Best for internet-exposed agents running dirty tasks.
Use when: Production business-critical agents, public-facing agents, any agent that reads untrusted content at scale.
Quick Decision Guide
| Situation | Recommended Tier |
|---|---|
| Starting out, learning Hermes | Tier 1 |
| Multiple personal projects | Tier 2 |
| Mix of work and personal | Tier 2-3 |
| Managing clients | Tier 3-4 |
| Agent on a VPS at all | Tier 5 (always) |
| Agent doing scraping or email triage | Tier 7 + Bitwarden Secrets Manager minimum |
| Production business-critical agent | Tier 8 with Agent Vault |