Hermes Agent vs QwenPaw

Hermes Agent

Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.

QwenPaw

Mail tools ask for approval by default, automatic mail handling may not delete permanently, and the security docs list what each sandbox backend fails to enforce. Usage data is sent by default, the default approval level passes every tool call no rule flags, and no privacy policy or security advisory is published.

Hermes Agent

1. Set approvals.mode: manual before giving it real accounts. The default smart lets an auxiliary model approve commands
2. Run the gateway with terminal.backend: docker or the project's Docker image when it reads mail, web pages or group chats
3. Set memory.write_approval: true and skills.write_approval: true to review what it saves about the owner
4. Leave approvals.cron_mode and approvals.unattended_mode at deny for scheduled and webhook runs
5. Set TELEGRAM_ALLOWED_USERS or the matching allowlist per channel. Never set GATEWAY_ALLOW_ALL_USERS=true

QwenPaw

1. Set QWENPAW_TELEMETRY_DISABLED=true before qwenpaw init --defaults or qwenpaw app. Both send usage data without asking
2. Set approval_level to STRICT or SMART in agent.json. The default AUTO runs every tool call no guard rule flags
3. Set dm_policy and group_policy to allowlist with allow_from on each channel. Both default to open
4. Set QWENPAW_AUTH_ENABLED=true before binding beyond 127.0.0.1. Requests from localhost skip login even then
5. Keep mail tools on ask for send_message, delete_message and delete_thread, and turn on Mail Access Control with automatic handling