AI agents: who controls the right to act, from super-apps to Hermes Agent?
AI agents: who controls the right to act, from super-apps to Hermes Agent?
“Change this order and let the customer know.” A short request hides several separate permissions. An agent needs to locate the order, check who can change it, consult stock or fulfilment information and obtain permission to send a message. A better model may understand the request perfectly without having any of those rights.
An AI agent’s right to act is the set of operations a business and its service providers actually authorise it to perform. That authority depends on identity, software connections, permissions and required approvals. Model capability matters, but it cannot replace the chain of authorisation.
The contrast between Chinese super-apps and more fragmented US services helps explain where that authority sits. It also makes the case for Hermes Agent, the open-source framework from Nous Research: an execution layer a business can organise around its own tools, without confusing technical independence with unrestricted access.
Integrated platforms and separate tools create different obstacles
In a fragmented customer journey, commerce, payments, messaging and identity may belong to different services. Moving between them requires connections, access rules and checks. Joining those steps creates integration work and a market for infrastructure that agents can use.
A super-app brings several functions into one environment. That can simplify the journey for users and approved partners. Yet the platform still decides which third parties may use each function. An integrated journey is not necessarily an open one.
This is an architectural comparison, not a complete description of two countries. The United States also has integrated platforms; China has several ecosystems and business agents. The distinction cannot support a prediction that agents will succeed in one country and fail in the other.
The APIs exist. Access conditions are the real issue.
It would be wrong to say that super-apps have no APIs. Official Weixin Mini Program documentation describes both authentication through wx.login and payments through wx.requestPayment. An API is a software interface through which an application can use a function. Its existence does not authorise any agent to use that function on any account.
The infrastructure work crosses the supposed geographical divide. On 30 April 2025, Visa announced Intelligent Commerce, extending its infrastructure and standards towards agent-led commerce. On 11 September 2026, Ant International announced the rollout of its Agentic Mobile Protocol with wallets and super-apps, naming Alipay China among its first-phase wallet partners.
These vendor announcements describe a direction and a phased rollout, not universally available autonomous payments. They show that agent access is being developed inside integrated ecosystems too. For a buyer, the useful question is specific: which services can this agent access, on whose behalf and under what safeguards?
A universal consumer agent and a business agent face different constraints
A consumer assistant expected to move freely between applications depends on many platforms whose rules it does not control. A business agent can have a much narrower remit: orders, CRM records and documents that one company is entitled to make available.
That difference changes what is feasible. A small business need not wait for an agent that can do everything on the internet before testing case reconciliation or response preparation. It does need to establish that its software supports the required operations and that it has the authority to delegate them.
An independent execution layer can coordinate several tools without moving the entire business into one super-app. Each connection still operates within the relevant service’s permissions.
What Hermes Agent adds to that architecture
As its official documentation explains, Hermes Agent is an agent framework built by Nous Research, not an AI model. It manages a working loop: receive a task, supply context to the model, call available tools, inspect their results and continue or stop.
Several documented capabilities matter when assessing it for business use:
- Choose the model separately from the execution layer. Hermes supports multiple providers and custom endpoints. Switching models need not replace the entire working interface, although task quality must be tested again.
- Use different interfaces. The terminal and messaging services such as Telegram, Slack or WhatsApp can provide access, depending on configuration. The messaging interface receives instructions; connected tools perform the operations.
- Retain context. Persistent memory and session search can reduce repeated explanations. They do not automatically create an approved corporate knowledge base.
- Reuse procedures. Skills are reusable instructions that the agent can create and improve through its work. In a business deployment, changes should be reviewed, tested and approved according to their impact.
The public Nous Research repository describes these mechanisms, tools and extensions. This learning loop includes improving procedures and working context. It does not mean that the underlying model retrains itself or that the agent should be free to rewrite its own authorisation rules.
To assess the framework against a complete assignment, our business guide to Hermes Agent follows the sequence of tool calls and identifies where human approval should remain.
Example: handling an order change without granting blanket access
Consider an illustrative workflow, not a measured client result. A company wants help with delivery-address changes before dispatch. With the necessary connections, Hermes could read the request, locate the order, check its fulfilment status and prepare both the update and a customer reply.
If the parcel has already been handed to the carrier, the procedure calls for escalation. An inconsistent address triggers a check. Sending the reply or applying the update remains subject to human approval until the business explicitly authorises those operations within a tested scope.
The intended benefit is less checking and re-keying across applications. It does not depend on bypassing customer identity or ignoring a platform’s refusal. Without a usable connector and permission, the agent must report the limitation rather than claim that the action was completed.
When moving from proposals to execution, least-privilege access helps separate reading, editing and sending. Evidence should come from the business system: an updated status, an operation identifier or a usable confirmation, not just “done” in the chat.
Hosting the agent does not make every data flow local
Hermes can run in an environment the company chooses, giving it control over part of the operation. Hosting the agent on your server is not the same as hosting the model. Information sent to an external model provider, search service or other remote tool still passes through that provider’s systems, subject to configuration and contracts.
Someone must also maintain the connections, protect credentials, apply patches, review logs and take responsibility for incidents. An open framework makes inspection and adaptation possible; it does not guarantee compliance or eliminate dependencies.
Agent memory may also contain assumptions or outdated habits. Where several agents need to apply the same commercial rules, a Company Brain with governed business knowledge can distinguish approved policy from something one agent retained during a conversation.
Five questions to answer before delegating a task
- What is the bounded assignment? Name the operation and its exceptions, rather than asking for a vaguely defined autonomous assistant.
- What access is actually available? Check applications, accounts, accessible data and permitted operations.
- Who approves what? Retain approval for payments, external commitments and sensitive changes; set limits before testing.
- What proves completion, and how can work stop? Verify the result in the target system and provide a way to revoke access if behaviour drifts.
- Who maintains the workflow? Assign responsibility for connectors, procedures, models and manual recovery.
At Say Digital, that scope comes before a prototype: one task, limited rights, tested failure cases and evidence of the result. Controlled deployment follows, with measurement of errors, recovery effort and observed time savings. Procedures can then improve without expanding permissions by default.
Considering Hermes Agent for your business tools? Talk to Say Digital about a first testable assignment, the connections it needs and its approval boundaries. The initial goal is not to give the agent every possible power. It is to prove that it can finish a useful task with the right permissions.
Sources: official Nous Research / Hermes Agent, Weixin, Visa and Ant International documentation and announcements, linked in the article and consulted for this publication. Capabilities depend on configuration; vendor announcements are not audited client outcomes.
