Notifications
Clear all
Topic starter
20/08/2026 5:24 pm
TL;DR: Hermes shows how an open agent harness can move beyond a simple model loop by treating sessions as infrastructure, separating tool registration from tool exposure, and preserving lineage during compression, according to Arize. The architectural lesson is that durable agent systems need explicit runtime boundaries, not just better prompts or larger context windows.
NHIMG editorial — based on content published by Arize: How Hermes implements an open source agent harness architecture
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, meaning organisations failing to scope AI access properly are 4.5x more likely to experience a security incident.
Questions worth separating out
Q: How should security teams govern AI agents that can remember user interactions across sessions?
A: Treat persistent memory as part of the security boundary, not as optional context.
Q: Why do AI agents complicate least privilege controls?
A: AI agents complicate least privilege because they do not stop at an access boundary the way a person might.
Q: What breaks when tool exposure is not separated from tool registration?
A: The model can inherit visibility into capabilities that were only meant to exist in the backend, which increases misuse risk and makes policy enforcement harder.
Practitioner guidance
- Define sessions as governed identity boundaries Assign ownership, start conditions, and termination criteria to each long-running agent session so context, tools, and outputs are tied to a controllable lifecycle boundary.
- Scope model-visible tools per run Keep the installed tool library broad if needed, but expose only the minimum tools required for the current task, profile, or delegated sub-run.
- Preserve compression lineage and audit metadata Record parent-child session relationships, summarisation events, and the reason a context boundary moved so investigators can reconstruct agent behaviour later.
What's in the full article
Arize's full blog covers the implementation detail this post intentionally leaves for the source:
- Provider adapter behaviour across Anthropic Messages, Codex Responses, Bedrock, and other runtime surfaces
- Session storage, FTS5 search, WAL journaling, and fallback behaviour for persistence and recovery
- Lifecycle hook execution points for policy enforcement, auditing, and host-side effects
- Profile isolation and cron handling details that show how unattended agent runs are governed in practice
👉 Read Arize's analysis of Hermes agent harness architecture →
Hermes agent harness architecture: what it means for long-running agents?
Explore further
20/08/2026 6:13 pm
Session-scoped agent governance is becoming the right unit of control. Hermes shows that long-running agents are not well described by a single prompt or a single execution. They need sessions, lifecycle transitions, and scoped runtime state. That aligns with how identity teams already think about non-human identities: control the session, not just the account. Practitioner conclusion: treat agent sessions as governed identities with explicit start, boundary, and end states.
A question worth separating out:
Q: How do teams know whether AI session compression is safe for governance?
A: Compression is safe only when the system preserves enough provenance to explain what changed and why. Teams should look for parent-child lineage, summarisation metadata, and the ability to reconstruct earlier context states. If compression produces a single rewritten transcript with no history, governance and forensics both lose critical evidence.
👉 Read our full editorial: Hermes as an agent harness reference for long-lived systems
