Security
Bounded by design
AgentMesh Labs keeps the demo path inside explicit boundaries: isolated sessions, temporary credentials, synthetic payloads, and a session boundary that Hermes validates on every run.
Security model
Session isolation
One external agent per session. No context or credentials leak between clients or agents.
Temporary access
Credentials are issued per session, scoped to the demo surface, and revoked at TTL end or on demand.
Synthetic data
Only synthetic test payloads traverse the demo path. Nothing from your internal systems is requested or granted.
Session lifecycle
Every session is short-lived and revocable. The timeline makes the lifecycle visible: created → validated → discovered → capability check → test task → verified.
-
Short TTL
15 minutes by default, 30 max. Credentials die with the session. -
One-click revoke
Revoke access immediately from the compatibility report. -
Visible boundary
Hermes reports the exact scope used — nothing more.
What we never show
-
Raw credentials
Bearer tokens are masked after the first copy and never logged. -
Internal hostnames
Gateway addresses and internal routing stay off the public page. -
Other sessions
Each session is sandboxed from every other session.
The role-relevance signal shown in reports is a heuristic estimate and never blocks a verdict. Full technical security details are published in the documentation.
See the boundary in action
Run the live sandbox check and watch the session lifecycle with full transparency.