Hermes Agent or n8n? How SMEs Can Build a Controlled AI Employee

The wrong question is: Which tool wins? The right one is: Where may a model choose the next step – and where must the process be fixed in advance?

A variable search path can be useful for research. When changing a price, making a booking, deleting something or messaging a customer, however, you do not want to discover only after execution which path the model chose. This boundary determines whether a general-purpose agent, an explicit workflow or a combination of both makes sense.

In this article, “AI employee” is an operational metaphor for software, processes and human accountability. It means neither an employee nor a legal entity – and certainly does not promise that a system will act autonomously and reliably.

Short answer: Hermes Agent starts as a general-purpose agent runtime: a model can choose tools and continue working across multiple steps. n8n starts as an explicit workflow of triggers and connected nodes, but can run an agent node within it. Wogenfels rule of thumb: Keep processes that can be described in advance in the workflow; give an open-ended subtask to a tightly constrained agent. Data protection and security depend on the entire data and permission path.

Product, version, licence and documentation status: 15 September 2026. Hermes Agent was reviewed against what was then the current release, v0.21.3, and tag v2026.9.14. Both projects are developing quickly; volatile details should be checked again before implementation.

Agent, workflow and “AI employee”: distinguishing three terms clearly

An AI agent connects a model with tools and an execution loop. The model can generate a tool call, receive its result and use it to determine the next step. This makes an agent flexible. It does not automatically make its planning or tool selection correct.

Workflow automation begins with an explicitly modelled process: a trigger starts connected steps, branches and error paths. Yet a workflow as a whole is not automatically deterministic either. APIs return changing data, and an embedded LLM or agent step remains probabilistic.

Here, “AI employee” describes the operational framework: What outcome should be produced? Which data, systems and permissions are required? What is logged? When must a person review the work? Who is accountable? Without this framework, even the most capable agent remains software with access rights.

A simple contrast in which “Hermes is agentic and n8n is deterministic” would be factually wrong. Alongside agent runs, Hermes also documents scheduled tasks and a script mode without a model. n8n, in turn, has a Tools Agent that can use the model to choose a connected tool. The more useful comparison is therefore:

• Hermes is agent-first: The task starts with a general-purpose agent runtime; within its permissions, the model can choose subsequent actions.
• n8n is workflow-first: The task starts with a defined control graph; individual nodes can work agentically when needed.

“First” indicates the focus, not an exclusive capability or a quality ranking.

What Hermes Agent actually is – and where its boundary lies

This article deals exclusively with the official NousResearch/hermes-agent project from Nous Research, not a language model with the same name or a third-party wrapper. At the cut-off date, GitHub listed v0.21.3 with tag v2026.9.14 as the latest release. According to the licence file, the code in this reviewed tag is under the MIT licence. This says nothing about the terms governing a connected model, provider, tool, plugin or dataset.

1. How does the work begin?

The architecture documentation describes an agent runtime that connects instructions, model providers, tools and sessions. If the model returns tool calls, the runtime executes them, returns the results to the context and continues the work loop. In the documented flow, only a text response ends the process. Details of tool execution and storage appear in the Agent Loop internals.

Hermes can store sessions and a memory state across multiple work steps. This is useful for longer, open-ended tasks: research paths, diagnosis or coding do not have to be forced into a single rigid run. Persistence is not magical, complete memory, however. Incorrect or unnecessary stored content, permissions, deletion and retention remain operational questions.

2. What remains open-ended, and what can run as a fixed process?

The Agent Loop is suited to variable follow-up work. At the same time, the Cron documentation describes one-off, recurring and event-triggered tasks. A no-agent mode can execute scripts without calling a model or provider. Hermes is therefore not limited to open-ended planning. This does not make it equivalent to a workflow system: domain states, error paths and business approvals must still be designed deliberately.

3. How are errors, approvals and security boundaries handled?

Technical retries and switching to a fallback model are described in the Agent Loop. Deciding when a business case must be stopped, escalated or resumed nevertheless remains a domain-specific design task.

The most important warning appears in the project’s own Security Policy: it describes Hermes as a “single-tenant personal agent”. The default terminal executes commands directly on the host. For a model that is deliberately misdirected, or misdirected by malicious input, the project regards technical separation at operating-system level as the fundamental security boundary. Under these security assumptions, approval dialogues, scanners and allowlists within the same process do not provide complete containment.

This is neither a blanket verdict of “insecure” nor a security certificate. It is a design requirement: with uncontrolled inputs, production systems or shared environments, the entire agent process needs suitable isolation enforced at operating-system level. A restricted terminal environment does not automatically protect connected tool servers, plugins, hooks or skills running in the agent process. Third-party extensions must be reviewed properly before installation.

An approval dialogue is not a sandbox. A person can approve or reject a specific action. That does not replace technical restrictions on the host, network, files, secrets and reachable systems.

4. What does this mean for operations and the data path?

According to the provider documentation, Hermes can use remote providers, custom OpenAI-compatible endpoints and local model servers. Supporting tasks can be routed differently from the main conversation. Installing Hermes Agent locally therefore does not automatically mean that all data remains local. The main model, supporting models, web search, browser, messaging and other tools must each be included in the data-path review.

The article “Which AI models can run locally?” explains which models are practical to test on your own hardware.

What n8n actually is – including its agent capabilities

1. How does the work begin?

n8n defines a workflow as a collection of connected nodes started by a trigger. The control flow is modelled in advance. This is particularly helpful when a process must be repeatable, connect systems and handle errors visibly.

2. What remains open-ended, and what can run as a fixed process?

The defined node graph remains the core model. Within that graph, however, the documented Tools Agent can use the model to decide which connected tool or API to use for each task. Its prompt, output format and iteration limit are configurable. The attached memory described on this page does not persist between sessions; this expressly does not mean that n8n cannot offer persistent memory in general.

3. How are errors and approvals handled?

The documentation distinguishes between manual, partial and production executions. For manual tests, data can be pinned to nodes; production runs ignore this test data. Error workflows, execution storage, progress and resume behaviour, timeouts and the redaction of input and output data, among other things, can be configured for each workflow.

These features do not provide automatic governance. Not every setting is enabled by default, details can depend on edition and plan, and stored executions can themselves contain confidential or personal data. Conversely, redacting everything removes information needed for troubleshooting and evidence. This is a deliberate trade-off.

For selected agent tools, n8n documents human approval before the tool call: the workflow pauses. The approval message can be configured to show the tool name and those fields in the tool input schema that the agent populated via $fromAI(). A reviewer can approve or reject the call. This is a valuable control point before a message or change. It remains a control point – not a sandbox or a guarantee that a person will spot an error.

4. What does this mean for operations and the data path?

According to the hosting overview, n8n is available as a managed cloud service or can be self-hosted on your own infrastructure. With self-hosting, the operator is responsible for setup, infrastructure, updates and maintenance. According to the privacy documentation, the operator is then also responsible for deleting or pruning stored execution data; the same page documents configurable telemetry that is enabled by default for self-hosted instances.

A self-hosted workflow can nevertheless send data to a configured LLM or other APIs. For its AI features, the n8n AI Terms state that customers using their own LLM provider choose the provider and credentials, and that data may be transferred there according to the configuration. The separate data flows described for the n8n Assistant on the privacy page must not be applied wholesale to a self-configured agent node.

The licence models also differ. For the reviewed version, the commit-pinned repository licence states: in the master branch, code outside the .ee files and included third-party components is under the Sustainable Use License. .ee code requires the Enterprise licence identified there, third-party components follow their own licences, and the file states that content from other branches is not licensed. This is not the same permissive MIT licence as the reviewed Hermes tag. For embedding, distribution or providing hosting as a service, the specific current licence framework must be reviewed.

Hermes Agent vs n8n: a decision matrix without a false winner

The following tables compare documented areas of focus, not exclusive capabilities. A feature may also be possible in the other system. Product and source status: 15 September 2026.

Controlling the work

Decision question	Hermes Agent: agent-first	n8n: workflow-first
Where does the work begin?	With instructions and context given to the agent runtime	A trigger starts an explicit node graph
Who chooses the next step?	The model can choose tools in the Agent Loop	The graph and rules lead; an agent node can choose tools locally
What is suitable for fixed tasks?	Cron and model-free script jobs are documented	Defined nodes and triggers form the core model
What is suitable for open-ended tasks?	The tool loop and stored sessions support variable follow-up work	Open-ended work can be embedded as an agent node
How does human approval work?	Approval is a process control; according to the Security Policy, it is not isolation	Selected agent tools can be approved or rejected before execution

Controlling operations

Decision question	Hermes Agent: agent-first	n8n: workflow-first
How are processes tested and resumed?	Tool calls and sessions need their own domain-specific acceptance testing; technical retries are described in the Agent Loop	Manual and partial runs and error and resume settings are documented
Where is the security boundary?	With uncontrolled inputs, isolate the entire agent process in line with the manufacturer’s security assumptions and give it minimal permissions	Deliberately restrict infrastructure, access, inputs and actions; workflow settings are only one part of this
What does hosting mean for the data path?	Local or remote main and supporting models, as well as tools, are possible	Cloud or self-hosted; third-party LLMs and APIs remain separate data paths
Which code licence was reviewed?	According to the licence file, the reviewed tag is MIT-licensed	master outside .ee and third-party components: SUL; the licence file defines separate boundaries for other content

The decision therefore depends primarily on four factors: uncertainty in the task, potential external impact, desired repeatability, and the data and permission path.

Six SME scenarios: which system should control the process?

These assignments are a Wogenfels starting heuristic for a pilot, not universal product rules. The data path, external impact and specific process can change which system should be in control.

1. Support triage

• Likely system in control for the pilot: Workflow.
• Limited AI role: Summarise or categorise the enquiry.
• Approval or stop rule: No automatic external response without a process accepted by the responsible subject-matter team.

2. Open-ended research

• Likely system in control for the pilot: Agent within a clearly defined assignment.
• Limited AI role: Vary search paths, collect sources and flag contradictions.
• Approval or stop rule: Verify facts; process uncontrolled web content only with suitable isolation.

3. Preparing proposals

• Likely system in control for the pilot: Workflow.
• Limited AI role: Draft text from approved facts.
• Approval or stop rule: Prices and discounts come from fixed logic; the accountable subject-matter reviewer approves dispatch.

4. Document processing

• Likely system in control for the pilot: Workflow.
• Limited AI role: Extract or classify unstructured content.
• Approval or stop rule: Validate the result against a schema; define data minimisation, permissions and deletion.

5. CRM and back office

• Likely system in control for the pilot: Workflow.
• Limited AI role: Produce a change proposal that can be validated.
• Approval or stop rule: Prevent duplicates; allow no unauthorised or duplicate changes.

6. Coding and IT

• Likely system in control for the pilot: Constrained agent pilot.
• Limited AI role: Work through an open-ended diagnosis or tool loop.
• Approval or stop rule: Do not give it access to a production host or secrets by default; test and review changes.

The recurring guiding question is: Can the next step be described as a rule, or does this particular step require constrained judgement?

The robust hybrid pattern: a constrained agent within a controlled workflow

In many business processes, neither a free-running agent nor a completely fixed sequence is the best description. A robust pilot pattern looks like this:

1. Verify the trigger and identity. The outer workflow accepts only authenticated, expected requests.
2. Minimise data. It turns the input into a structured assignment containing exactly the fields required.
3. Constrain the agent. The open-ended subtask runs in isolation, with minimal tools, permissions, runtime and iterations.
4. Validate the result. An output schema and domain rules determine whether the proposal may be processed further.
5. Handle uncertainty. Errors, missing fields or defined thresholds lead to a stop or a named subject-matter escalation.
6. Approve external impact. Before a message, booking, deletion or other critical action, the designated role reviews the content and parameters.
7. Execute and resume safely. The action is designed so that a retry does not cause an uncontrolled duplicate booking or message; status and error type are logged.

This is a Wogenfels architecture pattern, not a claim of a native or certified Hermes–n8n integration. The interface can look different depending on the infrastructure. At its core, it needs a clearly constrained assignment, a verified identity, minimal permissions, a time limit and an unambiguous error state.

Five plain-language questions for your internal team or supplier

1. What data enters the open-ended step – and what data comes out?
2. Whose technical identity does it run under?
3. Which systems may it only read, and which may it actually change?
4. After how much time, or in response to which result, does it stop automatically?
5. Who sees the error, decides the next step and documents it?

These questions translate input schema, authentication, permission budget, time limit and error handling into verifiable operational requirements.

Who is accountable in the pilot?

A “human in the loop” is not yet an allocation of responsibility. Before approval for production, at least the following roles should be assigned by name or within the organisation:

• Process ownership: Defines the outcome, rules and commercial boundary.
• Subject-matter approval: Assesses the content and external impact of the specific case.
• Technical operations: Takes responsibility for access, changes, updates and recovery.
• Data protection and security: Reviews the data path, permissions and necessary safeguards.
• Incident responsibility: Responds to misbehaviour, blocks access and coordinates the investigation.

Each role also needs a deputy and a defined response point. How a small organisation combines these tasks is a company decision – what matters is that they are not left unintentionally unassigned.

Security and data protection: map the real data path

“Self-hosted” describes a location; it is not a complete data-protection concept. For an agent or workflow pilot, record at least:

• agent software and technical host,
• main model and any supporting models,
• tools, APIs and MCP servers as external tool interfaces,
• messaging and notification channels,
• sessions, stored context and file storage,
• execution logs, error data and redaction of sensitive content,
• telemetry,
• backups, retention and deletion.

As soon as personal data is processed, the GDPR remains applicable. The GDPR on EUR-Lex sets out, among other things, lawfulness, purpose limitation, data minimisation and storage limitation. For a processor, Article 28 requires appropriate guarantees and a binding arrangement; Article 32 requires technical and organisational measures appropriate to the risk. The Austrian Data Protection Authority likewise emphasises principles, a legal basis and accountability for AI processing.

Article 22 does not apply to every agent output. It addresses solely automated decisions with legal or similarly significant effects and contains exceptions and safeguards. If a use case comes close to credit, recruitment or comparably significant decisions, the legal and organisational review belongs before the pilot. An ordinary approval click is not automatically a sufficient solution.

This classification provides general orientation and is not legal advice. Roles, legal basis, contracts and safeguards must be reviewed for the specific processing operation.

The operational control list

• Grant only the minimum necessary permissions.
• Isolate the agent process appropriately when handling uncontrolled input.
• Review skills, plugins, tools and integrations before use.
• Minimise test data and prepare it for lawful use.
• Configure retention, deletion and telemetry.
• Decide which logs are needed for evidence and troubleshooting, and which content must be redacted.
• Test approval points, stop rules and recovery.
• Define domain-specific acceptance criteria and metrics before the pilot.

The broader operating-model question – local, European cloud or hyperscaler – is covered in “Is local AI the only GDPR-compliant option?”.

Decision: choose the operating model first, then approve live operation

Step 1: Choose the operating model

1. Can the process be described completely in advance? Yes: start workflow-first. No: continue to question 2.
2. Is only one clearly separable subtask open-ended? Yes: test the hybrid pattern – workflow on the outside, agent on the inside. No: continue to question 3.
3. Is the overall task intentionally open-ended – such as research, diagnosis or coding – technically isolatable and subject to domain review? Yes: a constrained agent-first pilot can make sense. No: define the process more narrowly first; do not choose a tool yet.

Step 2: Apply the same approval criteria to all three paths

• Control: The operational control list is complete and the responsibility roles are assigned.
• External impact: Messages, bookings, deletions and other critical actions follow fixed rules, validation and appropriate approval.
• Article 22 GDPR: Not every agent output is affected. If the use case involves a solely automated decision with legal or similarly significant effects, Article 22 GDPR requires a separate legal and organisational review before the pilot. An ordinary approval click is not automatically sufficient.
• Data and permission path: The entire path is documented and accepted. If it is not, do not go live.

What do Hermes Agent and n8n cost to operate in an SME?

There is no robust universal figure. A licence label and hosting price alone are not enough, because implementation, model and tool usage, internal operations, human review and errors can make a greater difference.

Compare the current process, workflow, agent and hybrid over the same period and using the same volume assumptions:

• one-off implementation: process design, integration, testing, training and security work;
• ongoing monthly operations: runtime and hosting, models and tools, integrations and licences, updates, backups and operations;
• internal work: hours spent on subject-matter review, rework, incidents and maintenance;
• volume and quality: cases processed and, among them, cases professionally accepted;
• risk cost: probability multiplied by impact for plausible error cases.

A useful common unit of calculation is:

Cost per professionally accepted case = (allocated implementation + ongoing operations + internal review and rework + expected error costs) ÷ number of professionally accepted cases.

Set a budget ceiling and a stop threshold against the current process before the shadow run. Current product prices and plan features belong in the specific proposal – not as a rapidly ageing figure in this architecture comparison.

A risk-based pilot in six steps

1. Choose exactly one work outcome and a constrained process case.
2. Assemble a representative test dataset prepared in line with data-protection requirements.
3. Record the current process as a baseline and define domain-specific acceptance criteria, a budget ceiling and a stop threshold.
4. Work through the data path, control list, responsibility roles and approval criteria.
5. Run a shadow process without production impact.
6. After reviewing each case, decide whether to discard it, narrow the scope further, improve it or release it under controlled conditions.

Do not measure whether a demo “looks intelligent”. Measure correctness, necessary rework, error rate, throughput, escalations and unwanted actions for each case. There is no universal target for these metrics.

Conclusion: the cleanest system boundary wins, not the most intelligent tool

Hermes Agent and n8n are not interchangeable “AI employees”. Hermes focuses on open-ended, model-directed follow-up work; n8n focuses on explicit process control that can itself contain agentic steps. For many SME processes, a controlled combination is plausible: the workflow remains in control, the agent handles only the open-ended part, and people remain responsible for subject-matter approval and accountability.

If you want to clarify the model and hardware question first, the guide to local AI models, costs and TCO will help. You can find the implementation context under AI applications for businesses.

Would you like to assess a specific process without choosing a tool in advance? Bring the process, data types, desired external impact and current quality criteria. In a no-obligation initial meeting, we can determine whether an agent, workflow or hybrid warrants a measurable pilot.

Sources and currency

All 19 direct sources were checked on 15 September 2026. Vendor sources document features and terms, but do not constitute an independent comparison of maturity, security or performance. Versions, licences, features and plan details can change.

• Hermes Agent: official release-pinned README, releases, MIT licence, architecture, Agent Loop, Provider Runtime, Security Policy, Cron
• n8n: workflows, execution types, workflow settings, Tools Agent, human approval, cloud or self-hosted, privacy and security, commit-pinned repository licence, AI Terms
• Legal framework: GDPR on EUR-Lex, Austrian Data Protection Authority on the GDPR and the AI Act