Why route between cloud frontier models and an in-house model instead of picking one?

Because the two do different jobs. A frontier model like Claude Sonnet 5 or GPT-5.6 Terra earns its metered cost on genuinely hard, de-identified reasoning — synthesizing regulatory analysis, drafting a complex memo. Everything that touches client account data, holdings, or personally identifiable information has no business leaving the building at all, and the volume of routine drafting, inbox triage, and scheduling would make metered cloud calls prohibitively expensive. An in-house model on owned hardware handles both at a fixed cost regardless of volume. A gateway routes each step to whichever destination fits it, rather than forcing one model to do every job.

What does a Hermes Agent fleet look like for a regulated firm?

One Hermes profile per role — research, drafting, inbox, scheduling, compliance-check — each with its own memory, skills, credentials, and a model pinned to that role's data sensitivity. Bots coordinate through a persistent agent inbox and bot-to-bot hermes peer messages rather than a single monolithic agent, so a compliance-check bot can review what a drafting bot produced before anything reaches a client file, and every hand-off is a logged event.

Why does the June 2026 Anthropic suspension matter to this architecture?

On June 12, 2026, the US Commerce Department ordered Anthropic to suspend Fable 5 and Mythos 5 access for foreign nationals; because Anthropic had no reliable way to verify nationality in real time, it suspended both models globally for 18 days before the order was withdrawn. A firm with a research bot single-threaded to one cloud vendor would have gone dark. Routing with a named fallback destination and an in-house lane that depends on no cloud vendor at all turns a vendor-level outage into a degraded mode instead of a stoppage.

Is this a real client case study?

No. This is a deployment blueprint — a representative reference architecture composed from current, verifiable model, gateway, and framework releases as of September 2026. No firm is named, no client data is described, and no dollar outcomes are claimed or invented.

Deployment Blueprint: A Wealth Advisory Firm Runs a Hermes Agent Fleet on Hybrid Routing

This is a deployment blueprint — a representative reference architecture, not a real client engagement. No firm is named and no financial outcomes are invented.

The situation

A mid-sized private wealth advisory and trust firm, with offices in Toronto and Chicago, wants what its largest competitors already have: an agent fleet that drafts client communications, triages the inbox, tracks account and filing deadlines, and does first-pass research on regulatory and market questions — without a single advisor's data sitting on a vendor's server it doesn't control. The firm's technology committee had watched one frontier-model vendor go dark globally that summer. The mandate was explicit: use frontier models where they earn their cost, but never let the fleet's uptime, or a client's account data, depend on one vendor staying reachable.

The constraint

GLBA Safeguards Rule (US): the firm must protect nonpublic personal financial information across its full service-provider chain, including any AI processor that touches client data.
PIPEDA (Canada): accountability for personal information of Canadian clients follows the data, not the server — every processor in the chain, including a cloud model vendor, is in scope.
Advisor confidentiality duty: account holdings, transaction history, and estate and trust detail are the firm's most sensitive asset; a leak or an unlogged third-party access is a client-relationship failure independent of any statute.
Continuity: the June 2026 export-control suspension of Anthropic's flagship models (below) made single-vendor cloud dependence a governance question, not just an IT preference.

The architecture: a Hermes fleet behind a routing gateway

The fleet is built on Hermes Agent v0.21.0 "Pantheon" (MIT license): Bot Mode turns the session list into a roster of named bots, each a real Hermes profile at ~/.hermes/profiles/<name>/ with its own memory, skills, credentials, and a model pinned to that role. Bots coordinate through a persistent agent inbox, hermes peer bot-to-bot messaging, and cron jobs with continuity memory for anything that runs on a schedule. A unified MCP command centre gives every bot the same governed set of tools rather than each bot wiring its own integrations, and — the detail that matters most for a firm with a change-control obligation — Hermes requires explicit approval before any bot edits its own AGENTS.md, skills, or memory, so a bot cannot silently reconfigure itself.

Every model call from every bot passes through a self-hosted LLM and MCP gateway — LiteLLM or Bifrost — rather than calling a provider directly. The gateway is where routing, budgets, and audit live, independent of what any individual bot's prompt says.

Hermes profile roster

Bot	Role	Pinned model	Trigger	Hermes features in use
Research	Sourced first-pass research on regulatory and market questions, de-identified only	Claude Sonnet 5 (region-pinned cloud)	On-demand via `hermes peer`, plus cron for standing watches	Cron with persistent memory, MCP command centre for search/retrieval
Drafting	Composes client letters and memos in house voice	GLM-5.3-Flash + house-style LoRA	Invoked by Research or Inbox via `hermes peer`	Agent inbox hand-off, approval gate before skill/memory edits
Inbox	Triages the shared agent inbox, routes work to the right bot	GLM-5.3-Flash	Always-on	Agent inbox `@mention` routing, live subagent steering
Scheduling	Tracks account, filing, and review deadlines	GLM-5.3-Flash	Cron	Cron with persistent memory (`continuity=true`)
Compliance-check	Final review before anything reaches a client or file	Claude Sonnet 5 on de-identified excerpts, GLM-5.3-Flash if any client data remains	Invoked before every send or file action	Approval-gated skill edits, per-pass audit entry

flowchart TB
  R["Research bot"] --> GW
  D["Drafting bot"] --> GW
  I["Inbox bot"] --> GW
  S["Scheduling bot"] --> GW
  C["Compliance-check bot"] --> GW

  subgraph GW["Self-hosted LLM + MCP gateway (LiteLLM / Bifrost)"]
    route{"Route by data class + task"}
    budget["Per-team budget check"]
    audit["Audit log every call"]
  end
  route --> budget --> audit

  route -->|"de-identified, hard reasoning"| cloud1["Claude Sonnet 5\n(Bedrock/Vertex, region-pinned)"]
  route -.->|"fallback on outage"| cloud2["GPT-5.6 Terra\n(Azure Data Zone)"]
  route -->|"touches client data, or high volume"| onprem["GLM-5.3-Flash on vLLM\n(in-house)"]
  onprem --> lora["House-style LoRA finishing pass"]

  cloud1 --> audit
  cloud2 --> audit
  onprem --> audit

Routing rules

Data class × task	Destination	Cache policy	Budget owner
De-identified regulatory/market research, hard reasoning	Claude Sonnet 5, region-pinned via Bedrock or Vertex	Provider prompt caching on stable context	Research practice lead
Same, on primary-vendor outage	GPT-5.6 Terra via Azure Data Zone	Provider prompt caching	Research practice lead (fallback budget line)
Anything touching client account, holdings, or PII data	GLM-5.3-Flash, in-house vLLM	Local semantic cache only, never leaves the box	Compliance / infrastructure (fixed cost, no metering)
High-volume drafting, inbox triage, scheduling	GLM-5.3-Flash, in-house vLLM	Local KV cache	Operations
House-style finishing pass on client letters	LoRA adapter on GLM-5.3-Flash	Local	Compliance (adapter version pinned)
Compliance-check pass	Claude Sonnet 5 on de-identified excerpt, else GLM-5.3-Flash	Conditional on data class	Compliance

Pricing for the cloud tiers actually routed to (September 2026, list price per million tokens):

Model	Input (short / long context)	Output (short / long)	Cached input
Claude Sonnet 5	$2.00	$10.00	$4.00/M cache write (1-hr, intro period)
GPT-5.6 Terra	$2.00 / $4.00	$12.00 / $18.00	$0.20

Both vendors publish the same shape of pricing this year: a cheaper short-context tier and roughly double the rate past a long-context threshold. That two-tier structure is itself a routing input — a research bot's short standing-watch queries and its occasional long-document synthesis pass belong in different rate buckets, which the gateway's per-task routing rule already separates.

Governance: permissions, approvals, audit

Per-bot scoping. Each Hermes profile's credentials and MCP tool access are scoped to its role: Drafting has no send capability of its own, Compliance-check has read-only access to the case-management system, and Scheduling cannot touch client-communication tools. Bifrost or a dedicated MCP gateway enforces this at the tool level — a backend MCP server exposing forty tools gets filtered down to the two a bot actually needs, default-deny on the rest. Only a small fraction of MCP servers implement the mandatory OAuth 2.1 flow industry-wide, and unauthorized internal servers — "MCP shadow IT" — are a named current risk; routing every tool call through one approved gateway removes that path by construction rather than policy memo.

Approval before self-modification. Hermes' built-in requirement that a bot get human approval before editing its own AGENTS.md, skills, or memory closes a real gap: without it, a bot that learns a new workflow could silently rewrite its own instructions. With it, every change to how a bot operates is a reviewed event.

Budgets and audit at the gateway, not the bot. LiteLLM and Bifrost both support hard per-team and per-model budget caps with automatic reset, and both log every request — caller, model, data class, cost — independent of what any bot's own logs record. That gateway-level trail is what a supervisory review or a client-data incident response reads; it doesn't depend on trusting each bot's self-reporting. hermes peer messages between bots are logged the same way, so a hand-off from Research to Drafting to Compliance-check is one traceable chain, not five disconnected sessions.

Why routing with a fallback isn't optional

On June 12, 2026, the US Commerce Department ordered Anthropic to suspend access to its flagship models for foreign nationals over export-control concerns. With no reliable real-time way to verify nationality, Anthropic suspended the models globally, for every user, for 18 days, before the order was withdrawn June 30 and access resumed July 1. A firm whose Research and Compliance-check bots were single-threaded to that one vendor would have lost both functions with no warning. This is why the routing table names GPT-5.6 Terra as an explicit fallback rather than leaving the cloud tier single-vendor, and why the client-data and volume lane runs entirely on GLM-5.3-Flash in-house, dependent on no cloud vendor at all. The gateway makes the fallback mechanical: if a routing rule's primary destination errors or times out, the next rule in line takes the call, logged the same as any other request.

The direction of travel

Today's routing rules are static — a fixed table mapping data class and task to a destination. NVIDIA's open-source NeMo Switchyard points at where this goes next: rather than routing a whole request, it re-routes each step of a single agent workflow to whichever model fits that step, paired with a smaller open model for the high-volume steps inside the same task — NVIDIA's own testing reports this cuts task cost to roughly a third versus an all-frontier approach. The gateway here already separates by task and data class; a per-step router is the next layer on the same foundation, not a rebuild.

Rollout

Phase	Scope
0 — Foundation	Stand up the gateway, budgets, and audit logging; deploy GLM-5.3-Flash on in-house vLLM; validate against an evaluation harness before client data touches it
1 — Low-risk bots	Inbox and Scheduling live, entirely on the in-house lane, no cloud routing yet
2 — Cloud-routed research	Research bot live with de-identification checks and region-pinned Claude Sonnet 5; GPT-5.6 Terra wired as fallback
3 — Drafting and house style	Drafting bot live with the LoRA finishing pass trained on a quarter of reviewed output
4 — Compliance-check and full audit	Compliance-check bot gates every send/file action; the gateway audit log becomes the system of record
5 — Per-step routing	Evaluate a NeMo Switchyard-style per-step router against the static rule table once volume justifies it

Kept honest

This is a blueprint, not a client write-up: no firm is named, no client data is described, and no dollar savings are claimed. What is real: Hermes Agent v0.21.0's Pantheon-release feature set, GLM-5.3-Flash's specifications and MIT license, LiteLLM's and Bifrost's published capabilities, the September 2026 pricing snapshot for Claude Sonnet 5 and GPT-5.6 Terra, and the timeline of the June 2026 export-control suspension — sourced from vendor documentation, release notes, and reputable coverage current as of this writing. Where a vendor's own benchmark or throughput figure is the only source — gateway latency claims especially — treat it as a vendor claim to verify locally, not a guarantee. This market moves fast enough that any number here should be re-checked before it's used in a procurement decision.

See our agent teams solution for the broader delivery model, on-premise LLM deployment for the infrastructure that hosts the in-house lane, our GLM-5.3-Flash deployment guide for hardware sizing, our financial services practice for the regulatory grounding, and OpenClaw 2.0 vs. Hermes Agent for how Hermes compares to the other self-hosted agent framework in this space.

Deployment blueprints are representative reference architectures — anonymized and generalized from the deployment patterns we design. They are not client testimonials.