Claude Sonnet and Dome

1. 01

   Connect Anthropic

   The family: sonnet tag is what the pinning rule checks. The key itself never reaches an agent.

   $ dome models add sonnet-55-anthropic \
     --provider anthropic \
     --model claude-sonnet-5-5 \
     --api-key "$ANTHROPIC_API_KEY" \
     --attributes '{"family":"sonnet"}' \
     --gateway prod-gateway

2. 02

   Connect Amazon Bedrock

   Bedrock takes AWS keys, so this one is a dashboard step: region, us.anthropic.claude-sonnet-5-5, and the same family tag. The CLI has no flag for AWS keys.

3. 03

   Pool them for failover

   The pool is named for the model. A new Sonnet is a member swap. No agent needs a release.

   $ dome models pool create claude-sonnet-5-5 \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add claude-sonnet-5-5 sonnet-55-anthropic --priority 0
   $ dome models pool member add claude-sonnet-5-5 sonnet-55-bedrock --priority 1

4. 04

   Point your agent at the Gateway

   The Anthropic SDK works as is. Point it at the Gateway with the code reviewer's Dome key.

   import anthropic
    
   client = anthropic.Anthropic(base_url=GATEWAY_URL, api_key=DOME_AGENT_KEY)
   client.messages.create(
       model="claude-sonnet-5-5",
       max_tokens=2048,
       messages=[{"role": "user", "content": "Review this diff."}],
   )

5. 05

   Cap the spend

   A pool quota counts every call through the pool, whichever provider answers.

   $ dome quotas set --subject pool --pool claude-sonnet-5-5 \
     --unit provider_usd --limit 300 --window monthly

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Claude Sonnet itself, see Anthropic's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
unless { resource has family && resource.family == "sonnet" };