OpenZaps turn approved DeFi workflows into sealed policy capsules. Hermes can simulate, submit, monitor, alert, and revoke, but it cannot choose arbitrary targets, recipients, assets, or calldata.