Run your first agent (safely)

Time to think like an operator. Whether it's Hermes, OpenClaw, or the sandbox, running an agent well comes down to the same checklist:

1. Isolate it — container or dedicated server, never your main machine at first
2. Least privilege — start with read-only / draft-only access
3. Watch the loop — read what it does before trusting it
4. Set budgets — API spend limits, step limits