GPT and Dome

1. 01

   Connect OpenAI

   The key goes into Dome's vault and is sent as a bearer token at call time. Agents never hold it.

   $ dome models add gpt-openai \
     --provider openai \
     --model gpt-6-sol \
     --api-key "$OPENAI_API_KEY" \
     --gateway prod-gateway

2. 02

   Connect Azure OpenAI

   Azure needs your resource endpoint, the deployment name and an API version. The key is sent as the api-key header.

   $ dome models add gpt-azure \
     --provider azure_openai \
     --model gpt-6-sol \
     --provider-config '{"endpoint":"https://contoso-eu.openai.azure.com","deployment":"gpt-6-sol","api_version":"2024-10-21"}' \
     --api-key "$AZURE_OPENAI_API_KEY" \
     --attributes '{"retention":"zero"}' \
     --gateway prod-gateway

3. 03

   Pool them for failover

   Members are tried in priority order. Name the pool for the model and agents need no other change.

   $ dome models pool create gpt-6-sol \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add gpt-6-sol gpt-openai --priority 0
   $ dome models pool member add gpt-6-sol gpt-azure --priority 1

4. 04

   Point your agent at the Gateway

   The OpenAI SDK takes the Gateway URL as its base. The agent's Dome key replaces the provider key.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="gpt-6-sol",
       messages=[{"role": "user", "content": "Summarize this call transcript."}],
   )

5. 05

   Cap spend per agent

   An agent quota counts every model call that agent makes, through any pool.

   $ dome quotas set --subject agent --agent sales-assistant \
     --dimension llm --unit provider_usd --limit 200 --window monthly

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about GPT itself, see OpenAI's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when {
  principal has act_as &&
  principal.act_as.groups.contains("legal")
}
unless { resource has retention && resource.retention == "zero" };