Agent Guided Demo: Build your first governed AI agent
In this guided demo, you will build a friendly weather agent with Hermes, run it locally, and deploy the same agent to AgentPaaS Cloud.
Watch the weather demo
Watch the full walkthrough before you start, or keep it open while you follow the steps:
Open the weather demo on YouTube
You will see each protection working as you use it:
- Your agent runs inside an isolated container
- Network access starts closed and opens only for the weather service and your LLM provider
- API keys stay in the credential broker instead of entering agent code or chat
- Every build and run produces lineage and audit records
- The same signed agent package works on your Mac and in AgentPaaS Cloud
By the end, you will have a working agent, a clear record of what it did, and a practical way to govern its access as it runs.
Follow the steps in order. Paste the Hermes prompts exactly as written, and run any private credential commands in your own Terminal window.
What you need
| Mac | Hermes + local AgentPaaS runtime |
| Hermes | Install Hermes if needed |
| Trial invite | Claim email from AgentPaaS (get it here) |
| LLM key | Prefer OpenRouter and a cheap model |
| Hermes model | For a dedicated testing profile, google/gemini-3.8-flash is a good default. Other models work. |
Step 1: Claim your trial
Open the claim link in your invite email using the browser you plan to use for the demo. Create your password using the sign-in option shown in the claim page. Use the same email address that received the trial invitation.
Your trial is ready when you can open https://cloud.agentpaas.ai/ and see the AgentPaaS console.
Step 2: Install AgentPaaS in Hermes
In Hermes, paste:
Install AgentPaaS from github https://github.com/AgentPaaS-ai/agentpaas/tree/main/install
Hermes installs AgentPaaS and its local tooling. You will be prompted to restart the session. Quit (/quit) and restart your hermes session.
Step 3: Build the weather agent
In Hermes:
Build a weather agent that uses an LLM, and responds with a friendly demeanour
When Hermes asks for publisher identity, run this in your own Terminal (not in chat): agentpaas identity init --name <yourname> Do not use your Mac account name.
During the build, Hermes will ask you to add an LLM key, such as OpenRouter or another provider. Paste the key in a separate Terminal window when prompted. Never put the key in chat.
You are ready when a local invoke returns a friendly weather answer.
Step 4: Lineage and Audits
In Hermes:
Show me lineage and audits
Lineage is the signed build story of the agent artifact (who packed what version and digest).
Audit is the run log under policy, including egress_allowed and egress_denied.
For a CISO review, the pack records four fingerprints:
- Image digest: container that ran
- Policy digest: signed allow-list
- Build input digest: packed source
- SBOM digest: pack-time bill of materials
The simple weather agent SBOM is the OS (Debian slim) plus AgentPaaS harness Go modules. It is not a pip supply chain unless the agent declared pip dependencies.
The audit trail reads in order: run_start with isolated network, egress_allowed GET to wttr.in, egress_allowed POST to OpenRouter with credential ID openrouter-key brokered from Keychain, invoke, run_complete 0, and run_finalized 0 denials. The weather host appears before the LLM request, so the record shows a real fetch followed by summarization.
If the agent tried a website that was not on the allow list, you should see a denial recorded by the gateway. That is the product working.
Optional:
This shows how policy changes affect an agent.
Remove the weather host from the policy file, observe the denial in the audit, then add it back and confirm the agent can run again.
Demonstrate governance: remove the weather host from policy, repack, invoke and show the denial in the audit. Then add the host back, confirm with me, repack, and invoke successfully.
Step 5: Run it on AgentPaaS Cloud
In Hermes:
Make it run in the agentpaas cloud
Hermes will ask you to login to the Cloud, so the CLI can connect to it. In your terminal:
agentpaas cloud login
Cut and paste the link provided in the same browser you used to claim the trial, then tell Hermes to continue. Hermes will now build the agent, push it to the Cloud, deploy it, bind secrets to the Cloud gateway, and invoke it to show you the results.
Step 6: Look in the console
Open cloud.agentpaas.ai and check Components, Workflows, Deployments, Runs, and Logs. Expand a row to see detail. The weather walkthrough remains a single-agent run, not a workflow.
Optional: Schedule an automated run
Schedule this cloud deployment every 5 minutes, then show me how to disable it.
Or explore tabs yourself: Console tour.
What you proved
You built and ran an agent under runtime controls, then deployed the same governed agent to AgentPaaS Cloud. Here is what the demo showed:
- The agent ran inside an isolated container. Its work stayed inside the AgentPaaS runtime instead of running as your normal Mac user.
- The LLM could not bypass the policy. It never saw your keys, and the gateway denied egress to any site outside the approved policy. The policy-file test produced a recorded denial when the weather host was removed.
- Secrets stayed in the credential broker. You entered the LLM key in your separate Terminal. The key stayed out of chat and agent source while the Cloud gateway used it for the request.
- The build and run were recorded. Publisher identity created a fingerprint for the build. Lineage connected the signed artifact to its publisher, and the audit showed allowed and denied egress decisions.
- The same governed agent ran locally and in the Cloud. You built it on your Mac, pushed the signed package, deployed it, bound the secret through the gateway, and invoked it in AgentPaaS Cloud.
You have now seen how AgentPaaS contains an agent's access, records its actions, and carries the same controls from local development into the Cloud.
For limits and optional multi-step workflows, see platform limits and workflows.
Optional: after weather works, you may compose a workflow in Hermes. Weather stays a single-agent run.
If something fails: Troubleshooting.