Sign inSign up

Decide what every agent may do on every call.

Rules permit or forbid, guards inspect content, quotas cap use and spend, and escalations bring in a reviewer, all before the call runs.
See the platformRead the docs
RulesGuardsQuotasEscalations

Rules

Policy evaluated at the call boundary. A rule permits or forbids a call before it runs, on the agent, the caller, the tool and its arguments. Written at org, tenant, workspace or agent scope. Forbid wins, and the default is closed. Simulate before you ship.

Permit a specific action

Allow the registered agent to call the named tool.

Set a firm boundary

Forbid a sensitive action or constrain its arguments.

Test before deployment

Compare representative decisions against a proposed rule set.
dome — bash
permit (  principal == Dome::Agent::"support-triage",  action    == Dome::Action::"mcp:call",  resource  == Dome::MCPTool::"zendesk/update_ticket") when {  principal has act_as &&  resource.arguments.requester == principal.act_as.email};

Guards

Inspection and filtering of content in flight. Classify, redact or constrain a request or response before it passes, so a permitted call can't return data the caller shouldn't have. Versioned with rollback, assigned per connection and direction.

Redact a value

Replace a matched value before content continues.

Remove a field

Omit a field the agent should not receive.

Reject invalid content

Stop a tool request or response that fails an assigned Validator.
dome — bash
dome guards filters create pii-redact \  --config-from pii.jsondome tool guards filters set zendesk \  --direction response --filters pii-redact

Filter calls to services like

Quotas

Spend and usage ceilings bound to an identity. Bound to an agent, workspace or tenant, not to an API key, so attribution comes free. A denial at the limit is recorded like any other decision.

Give an agent a budget

Attach a limit to the agent responsible for consumption.

Constrain shared usage

Set a quota on a workspace or another supported shared subject.

Make exhaustion visible

Inspect the refusal when an applicable quota is exhausted.
dome — bash
dome model quota set \  --subject agent \  --agent support-triage \  --limit 2000000 \  --window 24h

Escalations

Rule decisions routed to a person or an AI judge. When a rule calls for review, route the decision to a human approver or an AI judge. Make escalation an explicit outcome alongside permit and deny.

Ask a person

Route a decision to a human when the action needs approval.

Ask an AI judge

Route a decision for AI review when the configured rule calls for it.

Every agent you run, under one system of control.

Talk with our teamGet started