The parent control plane.

Checklist

Complete these before the first sitting. Each item is a control, not a suggestion.

• 1. Restricted OS account

  The child’s Hermes profile runs on a user account that cannot install software, change system settings, or access your files. On Linux: a standard user with no sudo. On macOS: a managed account with Parental Controls. On Windows: a standard account with Family Safety restrictions.

• 2. Credentials review

  The child’s profile has no API keys, no OAuth tokens, no SSH keys. If a cloud model is used, the parent’s key is the only one — and the parent understands the billing and data path. Do not reuse an adult API key on a child profile without understanding what the provider sees.

• 3. Spend cap

  If using a cloud provider, set a usage limit. A child’s profile should not be able to spend more than a few dollars a month. Most providers support hard limits. If yours doesn’t, use a local model instead.

• 4. No messaging

  The child’s profile has no messaging tools — no email, no chat, no social posting, no Telegram. Conversation is with the model only. The parent is the channel to the outside world.

• 5. Local model default

  Prefer a local model (Ollama, llama.cpp) for child profiles. A local model keeps data on your machine. If a cloud model is necessary, read the provider’s data retention and training terms before using it. Hermes does not train on your chats by default, but cloud providers have their own policies.

• 6. Memory review calendar

  The child’s USER.md and MEMORY.md are parent-approved. Read them weekly at first, monthly once stable. Remove anything that identifies the child — names, school, schedule, address. The profile holds only what the sitting needs.

• 7. Write approval on

  Memory and skill writes wait for parent approval. The child cannot install new skills, modify their SOUL, or change their config. Every capability change is a parent decision.

• 8. Easy pause, easy delete

  You can stop the profile at any time by stopping the Hermes process. You can delete the profile by deleting its directory. Be honest about what deletion cannot remove — provider-side session logs and cloud model retention are separate. Record how to pause and delete in a private maintenance note.

Profile isolation

A child Hermes profile is a separate profile from any adult profile. Skills, memory, credentials, and conversation history do not cross.

• Do not copy adult skills into a child profile without parent review.
• Do not copy child memory into an adult profile.
• Do not share one config.yaml across profiles.
• Do not reuse an adult API key on a child profile unless you understand the billing and data path.

Data minimization

USER.md holds only parent-approved facts. No address, no school name, no schedule, no credentials. The pairing line names the sitting — not the child’s full identity.