> ## Documentation Index
> Fetch the complete documentation index at: https://mandate-db2d83af-26675499.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Short answers about scope, rivals, approvals, data, and proof.

> [accordion] Does Mandate change Hermes itself?
>
> No. It is a standalone plugin. It registers `pre_tool_call` and `post_tool_call`, a CLI, a slash command, and a read-only tool. It does not patch Hermes, wrap binaries, or edit Hermes config.

> [accordion] Does this fix the open Hermes cron\_mode bugs?
>
> No. Issues [#20984](https://github.com/NousResearch/hermes-agent/issues/20984), [#60505](https://github.com/NousResearch/hermes-agent/issues/60505), [#144434](https://github.com/NousResearch/hermes-agent/issues/144434), [#83626](https://github.com/NousResearch/hermes-agent/issues/83626), and [#58673](https://github.com/NousResearch/hermes-agent/issues/58673) are still open in Hermes. Mandate works around the same unattended-job risk in the plugin hook. Cron violations are always blocked, and Mandate never returns `approve` from a cron run.

> [accordion] How is this different from Hermes Guard or agent-security-guard?
>
> Those plugins use hand-written fixed pattern lists. Mandate learns a per-job policy from observed runs, then a human approves it. They solve different problems and can run together. See [Why this exists](https://mandate-db2d83af-26675499.mintlify.site/index.md#how-it-is-different).

> [accordion] Why do I have to wait for three runs?
>
> `propose` works after one run, but it warns under 3. The compiler's `MIN_RUNS` is 3, because a single run is a thin sample. Review a short-run proposal carefully before approving it.

> [accordion] Does observe mode ever block?
>
> No. Observe records calls and, if a policy is already approved, marks what would have been blocked. Internal errors in observe mode also do not block. Enforce is the only mode that blocks.

> [accordion] Can I approve from a script?
>
> Yes, with `--yes`. Without a TTY, `approve` refuses unless `--yes` is passed, so a cron job cannot approve its own mandate.

> [accordion] Are interactive chats covered automatically?
>
> No. Only after `/mandate scope <job>`. Cron runs are covered automatically through the cron execution identity.

> [accordion] Where is my data, and does Mandate call home?
>
> Everything stays in `<HERMES_HOME>/plugin-data/mandate/mandate.db` (or `MANDATE_DB`). The plugin never opens a socket, uses no credentials, and sends no telemetry. Disable and delete that directory to remove it. See [Configuration](https://mandate-db2d83af-26675499.mintlify.site/configuration.md).

> [accordion] Is this a sandbox?
>
> No. It checks tool arguments before the tool runs. It cannot see what an allowed program does afterward, and it cannot catch a symlink swap between check and use. Read [Security model and limits](https://mandate-db2d83af-26675499.mintlify.site/security.md).

> [accordion] How do I rerun the proof the README cites?
>
> `make prove` or `make prove HERMES_TAG=v0.23.1`. CI runs both tags. See [Proof](https://mandate-db2d83af-26675499.mintlify.site/proof.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.