Mistral and Dome

1. 01

   Connect Mistral

   The provider id is mistral. The region attribute is your label, and rules read it.

   $ dome models add mistral-api \
     --provider mistral \
     --model mistral-large-2512 \
     --api-key "$MISTRAL_API_KEY" \
     --attributes '{"family":"mistral","region":"eu"}' \
     --gateway prod-gateway

2. 02

   Connect NVIDIA NIM

   The same open weights, under NVIDIA's model id.

   $ dome models add mistral-nvidia \
     --provider nvidia \
     --model mistralai/mistral-large-3-675b-instruct-2512 \
     --api-key "$NVIDIA_API_KEY" \
     --attributes '{"family":"mistral","region":"us"}' \
     --gateway prod-gateway

3. 03

   Pool them for failover

   Mistral's API leads and NVIDIA follows. Agents only ever send mistral-large-3.

   $ dome models pool create mistral-large-3 \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add mistral-large-3 mistral-api --priority 0
   $ dome models pool member add mistral-large-3 mistral-nvidia --priority 1

4. 04

   Point your agent at the Gateway

   Mistral's API speaks the OpenAI format, so the agent's OpenAI client works once it points at the Gateway.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="mistral-large-3",
       messages=[{"role": "user", "content": "Draft a reply to this leave request."}],
   )

5. 05

   Cap spend per person

   An act-as quota follows the verified person, across every agent that acts for them.

   $ dome quotas set --subject act-as --act-as l.moreau \
     --dimension llm --unit provider_usd --limit 50 --window monthly

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Mistral itself, see Mistral AI's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when { principal has act_as && principal.act_as.groups.contains("eu") }
unless { resource has region && resource.region == "eu" };