Gateway Boundaries
A gateway connects approved messaging platforms to Hermes. It validates sender and chat identity, routes messages into isolated sessions, applies platform-specific tool policy, and requires approvals for consequential actions. Rate limits and pairing reduce abuse. EchoNet.ing remains static documentation and has no gateway credentials or control path.
Configure tokens locally and verify platform identity without printing secrets.
Default deny; approve the minimum identities and destinations.
Separate profiles, chats, topics, and sensitive workflows.
Expose only tools appropriate to that channel and trust level.
Verify authorized messages, blocked senders, approval flow, and error alerts.
Boundary controls
| Control | Purpose | Proof |
|---|---|---|
| Allowlist / pairing | Restrict who can invoke the agent | Authorized and denied test messages |
| Session isolation | Prevent context crossover | Distinct session identifiers and history |
| Approvals | Pause consequential commands | Visible approve/deny flow |
| Rate limiting | Reduce abuse and runaway loops | Threshold and recovery test |
| Delivery verification | Confirm output reached target | Platform message ID or read-back |
What breaks—and how to recover.
Check recent inbound logs, allowlists, and model health—not stale status alone.
Use per-chat/topic session keys and isolated profiles.
State clearly that documentation is static and management surfaces remain private.
Copyable implementation prompt
Design a messaging gateway for [PLATFORM]. Define authentication, allowlists, pairing, session keys, profile routing, tool policy, approvals, rate limits, logging, delivery verification, and emergency shutdown. Keep the public website fully segregated.
Use placeholders for paths, accounts, endpoints, identities, and credentials. Never publish secret values, private records, or a live control surface.
Verification gate
- Unauthorized senders are denied
- Sessions do not share private context
- Consequential tools require approval
- Rate limits and failure alerts work
- Public pages contain no control credentials or endpoints