Gemini and Dome

1. 01

   Connect Gemini 3.8 Flash

   Pass the service account's JSON key as the credential. Dome stores it in its vault and exchanges it for Google access tokens at call time.

   $ dome models add gemini-38-flash \
     --provider google \
     --model gemini-3.8-flash \
     --provider-config '{"project":"acme-agents","location":"us-central1"}' \
     --api-key "$(cat vertex-sa.json)" \
     --gateway prod-gateway

2. 02

   Connect the fallback and Pro

   One connection per model. Tag Pro so a rule can name it.

   $ dome models add gemini-25-flash --provider google --model gemini-2.5-flash \
     --provider-config '{"project":"acme-agents","location":"us-central1"}' \
     --api-key "$(cat vertex-sa.json)" --gateway prod-gateway
    
   $ dome models add gemini-pro --provider google --model gemini-3.1-pro \
     --provider-config '{"project":"acme-agents","location":"us-central1"}' \
     --api-key "$(cat vertex-sa.json)" --attributes '{"tier":"pro"}' \
     --gateway prod-gateway

3. 03

   Pool the Flash models

   Members are tried in priority order. Agents send the pool's name.

   $ dome models pool create gemini-flash \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add gemini-flash gemini-38-flash --priority 0
   $ dome models pool member add gemini-flash gemini-25-flash --priority 1

4. 04

   Point your agent at the Gateway

   Any OpenAI-compatible client works. Dome translates the request to Gemini's format.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="gemini-flash",
       messages=[{"role": "user", "content": "Extract the invoice fields."}],
   )

5. 05

   Cap the spend

   A model quota counts every call to that connection, through pools or directly.

   $ dome quotas set --subject model --model gemini-pro \
     --unit provider_usd --limit 400 --window monthly

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Gemini itself, see Google's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when { resource has tier && resource.tier == "pro" }
unless {
  principal has act_as &&
  principal.act_as.groups.contains("ml-research")
};