gpt-oss and Dome

1. 01

   Connect Groq

   On Groq the model is openai/gpt-oss-120b. Tag the connection weights: open; the key never leaves Dome.

   $ dome models add gpt-oss-groq \
     --provider groq \
     --model openai/gpt-oss-120b \
     --api-key "$GROQ_API_KEY" \
     --attributes '{"weights":"open"}' \
     --gateway prod-gateway

2. 02

   Connect Cerebras and Together AI

   Same weights, each host's own id. Tag them the same way.

   $ dome models add gpt-oss-cerebras \
     --provider cerebras \
     --model gpt-oss-120b \
     --api-key "$CEREBRAS_API_KEY" \
     --attributes '{"weights":"open"}' \
     --gateway prod-gateway
    
   $ dome models add gpt-oss-together \
     --provider together \
     --model openai/gpt-oss-120b \
     --api-key "$TOGETHER_API_KEY" \
     --attributes '{"weights":"open"}' \
     --gateway prod-gateway

3. 03

   Pool them for failover

   Groq leads. A nightly job that loses Groq mid-run carries on through Cerebras, then Together.

   $ dome models pool create gpt-oss-120b \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add gpt-oss-120b gpt-oss-groq --priority 0
   $ dome models pool member add gpt-oss-120b gpt-oss-cerebras --priority 1
   $ dome models pool member add gpt-oss-120b gpt-oss-together --priority 2

4. 04

   Point your agent at the Gateway

   The nightly job uses the OpenAI SDK with the Gateway as its base URL and its own Dome key.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="gpt-oss-120b",
       messages=[{"role": "user", "content": "Summarize last night's error logs."}],
   )

5. 05

   Cap calls per caller

   With --per-caller, a model quota applies to each agent and each verified person separately.

   $ dome quotas set --subject model --model gpt-oss-groq --per-caller \
     --unit calls --limit 2000 --window daily

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about gpt-oss itself, see OpenAI's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when { !(principal has act_as) }
unless { resource has weights && resource.weights == "open" };