Hey,

if your AI agent runs on your Mac and you want to use Time Machine you should read this.

The problem: my agent (Hermes) has its own user account. If that account ever gets compromised, ransomware, a broken process, whatever every Time Machine backup on that machine is gone too. Your agent and your backups on the same account means one attack takes out both. i backup my macbook and my GFs macbook on the same HDD pluged into my Mac Mini running Hermes.

So I locked my agent out of every Time Machine volume. No read, no write, no delete.

Sounds simple. Took me three attempts and two destroyed sparsebundles to get right. macOS has some surprises in store a chmod -R that silently corrupts backups, a "wheel" group that doesn't even exist on macOS.

The working solution: root:admin, mode 770, and knowing who actually writes the backup (hint: it's not who you think).

I wrote it all up what broke, why it broke, and the exact commands that work so you don't have to destroy your own backups to learn it:

→ https://blog.holmebengt.com/post.html?id=time-machine-isolation

Also: my new video is up — 5 student automations with Hermes Agent, from AI-generated Anki cards to a quiz site reachable on every device, all for under $25/month:

→ https://youtu.be/EODSbfLXFDg

enjoy 😉