Hermes Agent For Customer Support: Draft-Only Setup In 8 Steps

Hermes Agent for customer support works best as a draft-only help desk: the agent reads, sorts and writes, and a person on your team presses send.

That's how I'd set it up, and this walkthrough gives you the exact order: mailbox, allowlists, a policy skill, a triage channel, two scheduled jobs, your help desk, and the approval config.

Every setting below comes from the official Hermes Agent docs or the plugin catalog at v0.23.0, released 5 November 2026.

Want my team to map your support flow before you install anything? Book a free SEO strategy session.

The Rule Before Step 1: Hermes Sends What It Writes

Hermes has a strong approval system, but it guards dangerous shell commands, not messages.

The security page says each command is checked against a list of dangerous patterns, and a match needs your explicit yes.

No page describes a built-in step that holds an email reply or a Slack post until you approve it.

The email gateway replies in the same thread on its own, and cron jobs deliver their output straight to the chat or platform you name.

So the whole design below keeps the customer one step away from the agent.

Hermes drafts. A human sends. The only exceptions are the opt-in ones I point out in Steps 6 and 7.

Step 1: Give The Agent Its Own Mailbox And A Staff-Only Allowlist

Create a fresh mailbox for the agent, such as agent@yourshop.com.

The email docs are blunt about this: don't use a personal inbox, because the password sits in .env and the agent gets full IMAP access.

Run hermes gateway setup, pick Email, and the wizard asks for the address, the password, the IMAP and SMTP hosts, and the allowed senders.

List only your staff as allowed senders:

# ~/.hermes/.env
EMAIL_ALLOWED_USERS=sam@yourshop.com,jo@yourshop.com

Now your team can forward a customer email to the agent and get a draft back, while customers can't reach it directly.

With an allowlist set, anyone else is ignored. Leave EMAIL_ALLOW_ALL_USERS off; the docs flag it as use-with-caution because it admits every sender.

If you'd rather strangers hear something, set platforms.email.unauthorized_dm_behavior: decline. They get one polite refusal, then silence for 24 hours.

One more setting trips people up: Hermes only acts on mail whose From: domain passes DMARC or aligned SPF/DKIM, and it needs EMAIL_AUTHSERV_ID pinned to the id your mail server writes.

Open a delivered message's raw source, copy the token before the first semicolon of the top Authentication-Results header, and paste it in. For Gmail that's mx.google.com.

Step 2: Lock Down Every Chat Channel With Allowlists And Pairing

Every chat platform gets the same treatment.

Set a per-platform list such as TELEGRAM_ALLOWED_USERS or SLACK_ALLOWED_USERS, or a global GATEWAY_ALLOWED_USERS.

For chat-style DMs the default for unknown users is pairing: they receive an 8-character code, and nothing happens until you run hermes pairing approve telegram <code>.

You can switch a platform to decline instead and edit the wording with unauthorized_dm_decline_message.

Platform sections override the global default, so Telegram can pair while WhatsApp stays quiet.

For a support desk I'd approve only staff in every channel during the first fortnight.

🔥 Get the support-desk setup on video, step by step Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS, four coaching calls a week and 3,400+ members comparing Hermes configs. → Join the AI Profit Boardroom

Step 3: Write Your Policies Into A Support Skill

Your refund window, delivery times, booking rules and tone of voice belong in one skill, not scattered through prompts.

Skills live in ~/.hermes/skills/, follow the agentskills.io format, and load only when a task needs them.

The fastest route is /learn: point it at your FAQ page or a folder of policy docs and it authors the skill for you.

Then read the result line by line, because the agent writes what it found, and what it found may be out of date.

One gotcha matters here: the docs say the agent can modify or delete any skill, including from its background self-improvement review.

For a policy file that customers rely on, turn on the write gate:

# ~/.hermes/config.yaml
skills:
  write_approval: true

Edits are now staged under ~/.hermes/pending/skills/, and you review them with /skills pending, /skills diff <id> and /skills approve <id>.

Add three lines to the skill itself: answer only from this file, write "needs a human" when the answer isn't here, and never promise refunds, credits or dates.

Step 4: Bind The Skill To A Slack Triage Channel

Make a private Slack channel, for example #support-drafts, and invite the bot with /invite @Hermes Agent.

The Slack page warns that the bot never joins channels by itself, which is the most common reason it stays silent.

Next, preload your support skill every time a session starts in that channel. The docs name a support triage channel as a good fit for this:

# ~/.hermes/config.yaml
slack:
  channel_skill_bindings:
    - id: "C0SUPPORT01"
      skill: support-policies

The key is the Slack channel ID, found under channel details, About, at the bottom.

From now on, a teammate can paste a customer message into the channel and the answer starts with your policies already loaded.

The draft lands in Slack, where your teammate edits it and sends it from your normal help desk or inbox.

Step 5: Schedule The Triage Run And The Evening Summary

Two cron jobs carry most of the routine work.

The bundled skills catalog ships himalaya for IMAP and SMTP from the terminal and email-inbox-triage, which the catalog sums up as triage that drafts replies safely.

Point the triage job at a read-only copy of your support inbox, or a mailbox you forward to, and tell it plainly not to send:

/cron add "every 30m" "Read new mail in the support inbox. Sort each message as order, booking, bug, billing or other. Draft nothing to customers. Post the sorted list with one-line summaries to #support-drafts." --skill himalaya --skill email-inbox-triage

The second job runs once a day and reports, without changing anything:

/cron add "every 1d at 18:00" "Summarize today's #support-drafts threads: messages per category, questions that repeated, cases still open, and one gap in the support-policies skill." --skill support-policies

Cron jobs deny dangerous commands by default (cron_mode: deny), so neither job can run a risky shell command while you sleep.

Our Hermes cron job walkthrough covers delivery targets and model pins in more depth.

Step 6: Connect Your Help Desk With The Freshdesk Plugin Or The Intercom MCP

Only two help desks have a dedicated entry in the Hermes catalogs today.

freshdesk is a community plugin. Its catalog entry calls it an unaffiliated connector, not a Freshworks product.

Install it with hermes plugins install freshdesk and add FRESHDESK_DOMAIN and FRESHDESK_API_KEY to the profile.

It reads tickets, conversations and contacts, and it has five write tools: private note, new ticket, public reply, time entry and status or priority change.

Its catalog entry says those five escalate to Hermes human approval and fail closed when nobody is there to answer. That's the safeguard you want on a public reply.

Intercom comes through the MCP catalog instead: a Nous-reviewed intercom entry that points at Intercom's own hosted server for conversations, tickets and customer data.

Run hermes mcp install intercom, sign in through the browser, then mark the server untrusted so every write-capable call asks first:

# ~/.hermes/config.yaml
mcp_servers:
  intercom:
    url: https://mcp.intercom.com/mcp
    auth: oauth
    trust: untrusted

The MCP config reference says the default is full, which never prompts, so this line is not optional for support work.

There's no Zendesk, Help Scout or Chatwoot entry in either catalog, so don't plan around one.

Step 7: Customer-Facing Telegram, With Draft-And-Approve

If customers already message your business on Telegram, there's one documented way to let Hermes help without letting it talk to them unsupervised.

hermes-telegram-business comes from Nous Research's hermes-labs-plugins repo, a set of experimental plugins Nous built but doesn't support, listed in the community tier.

It runs in Telegram Business Mode: Hermes drafts a reply to each customer message and DMs the draft to you with Send, Edit and Discard buttons.

Nothing reaches the customer until you tap Send.

Install it with hermes plugins install hermes-telegram-business, then test it with your own second account before a real customer writes in.

Each customer message goes to your active model to write the draft, and drafts are kept locally in telegram-business/state.db under your Hermes home.

Step 8: Set The Approval Config And Test It

Here's the block I'd leave in place for any support profile:

# ~/.hermes/config.yaml
approvals:
  mode: smart
  cron_mode: deny
  single_query_mode: deny
  unattended_mode: deny

These are the documented defaults, so the point is to check nobody changed them.

Never run a support profile with /yolo or approvals.mode: off; the MCP reference says both skip the untrusted-server prompt.

Then test three things by hand: a forwarded email returns a draft, a stranger's DM gets a pairing code or a refusal, and a Freshdesk or Intercom write asks before it runs.

If any test fails, fix it before the first real ticket.

Gotchas I'd Check Before Go-Live

Telegram groups: privacy mode is on by default, so the bot only sees some group messages. After changing it, remove and re-add the bot, or nothing changes (Telegram page).
WhatsApp: the official Cloud API route needs a Meta Business account, a dedicated business number and a public HTTPS URL, and replies after 24 hours need a pre-approved template (WhatsApp Cloud page). That 24-hour rule is Meta's, not a Hermes limit.
Webhooks: the webhooks page says to treat payload text as untrusted, scope the toolset, and keep approvals on for outbound operations.
Logins: store help-desk passwords in the Hermes vault, where the docs say the model never sees them.
Handover: developers can use the pre_gateway_dispatch hook, which the hooks page lists for human handover: customer messages are taken in silently while the owner runs the chat.

Two Worked Examples: A Plumber And An Online Shop

A two-van plumbing firm

Job requests from the website form land in a shared inbox.
Every 30 minutes the triage job reads them and tags anything with "leak", "no water" or "flood" as urgent.
It posts the urgent list to the owner's Telegram and the rest to Slack.
The office manager pastes a message into #support-drafts, gets a reply drafted from the call-out policy, and sends it from the normal inbox.

A small online shop on Freshdesk

The Freshdesk plugin reads new tickets and the customer's earlier conversations.
Hermes adds a private note with a suggested answer taken from the returns skill.
Because private notes are a write tool, Hermes asks for approval first, and a staff member approves the note.
The staff member edits the suggestion and sends the public reply from Freshdesk.

📞 Want this mapped to your own inbox and channels? Book a free SEO strategy session and my team will look at where your support questions arrive and which step to automate first. → Book your free strategy session

What Hermes Doesn't Cover For Support

No Zendesk, Help Scout, Chatwoot, HubSpot or Shopify entry exists in the plugin or MCP catalogs at v0.23.0.

Most entries that do exist are community plugins, which means human-reviewed for admission, not maintained by Nous.

And there is no built-in approve-before-send for messages, so unattended customer replies are something I'd never switch on.

If you want a hosted assistant instead of a self-run one, our Grok Bot for customer support setup covers that route.

For the trainings, the Agent OS and live help with configs like these, join the AI Profit Boardroom.

Also On Our Network

FAQ: Hermes Agent For Customer Support

Can Hermes reply to customer emails without me checking them?

The email gateway can reply in-thread on its own, but Hermes has no built-in step that holds a message for approval. Keep customers off the allowlist and have staff send every reply.

How do I stop the agent rewriting my refund policy skill?

Set skills.write_approval to true in config.yaml. Every skill edit is then staged, and you approve or reject it with the /skills commands.

Does the Freshdesk plugin ask before it posts a public reply?

Its catalog entry says the five write tools, including the public reply, escalate to Hermes human approval and fail closed when no person is present.

Why does my Slack bot ignore the support channel?

The bot never joins channels by itself. Invite it with /invite @Hermes Agent, and check the channel ID in your skill binding.

Is there a Zendesk plugin for Hermes?

No. At v0.23.0 neither the plugin catalog nor the MCP catalog has a Zendesk entry; Freshdesk and Intercom are the help desks listed.

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
I've grown a YouTube channel to 400,000+ subscribers.
I wrote "Link Building Mastery".
My Udemy courses have taught over 29,000 students.

→ Get my best AI training inside the AI Profit Boardroom

Do Step 1 today, and book a free strategy session if you want a second pair of eyes on your draft-only setup for Hermes Agent for customer support.