Gemma and Dome

1. 01

   Connect DeepInfra

   DeepInfra's id is google/gemma-4-31B-it. Dome keeps the DeepInfra key out of every agent's hands.

   $ dome models add gemma-deepinfra \
     --provider deepinfra \
     --model google/gemma-4-31B-it \
     --api-key "$DEEPINFRA_API_KEY" \
     --attributes '{"family":"gemma"}' \
     --gateway prod-gateway

2. 02

   Connect NVIDIA NIM

   The provider id is nvidia. NVIDIA writes the model id in lower case.

   $ dome models add gemma-nvidia \
     --provider nvidia \
     --model google/gemma-4-31b-it \
     --api-key "$NVIDIA_API_KEY" \
     --attributes '{"family":"gemma"}' \
     --gateway prod-gateway

3. 03

   Pool them for failover

   The two ids differ only in case. The pool hides both behind gemma-4-31b.

   $ dome models pool create gemma-4-31b \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add gemma-4-31b gemma-deepinfra --priority 0
   $ dome models pool member add gemma-4-31b gemma-nvidia --priority 1

4. 04

   Point your agent at the Gateway

   Contractor-facing agents use the OpenAI SDK pointed at the Gateway, with their own Dome key.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="gemma-4-31b",
       messages=[{"role": "user", "content": "Find the VPN setup steps in the knowledge base."}],
   )

5. 05

   Cap daily calls

   One call counts once, on whichever host served it.

   $ dome quotas set --subject pool --pool gemma-4-31b \
     --unit calls --limit 50000 --window daily

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Gemma itself, see Google's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when { principal has act_as && principal.act_as.groups.contains("contractors") }
unless { resource has family && resource.family == "gemma" };