See every call,
and act on it where your teams work.
One audit trail for every agent, streamed and exported to the tools you already run. Signed events reach anything that needs a response.
Audits
The event trail, after the fact and live. One vocabulary for every call: agent, caller chain, target, arguments, rule version, outcome. Reconstructing what an agent did is one query. The same trail streams live, and exports continuously or on a schedule to the SIEM and observability tools you already run.
EventTimeAgent
model.call10:42:11support-triage
tool.call10:42:09support-triage
tool.call10:42:07support-triage
tool.call10:42:06support-triage
model.call10:42:04support-triage
tool.call10:42:02support-triage
tool.call10:41:58support-triage
tool.callDeny
Ruleforbid-deletes · v12
Agentsupport-triage
CallerMCm.chen
Targetzendesk/delete_ticket
ticket_id4821
Investigate a decision
Find the request and the context behind its outcome.
Audit eventsact_9f2k1p
tool.callkb/searchact_b81e
tool.calldelete_ticketact_9f2k
model.callprod-fastact_c03d
tool.callupdate_ticketact_9f2k
tool.calllist_usersact_51aa
tool.callread_ticketact_9f2k
model.callprod-fastact_c03d
model.callprod-reasoningact_9f2k
4 events · 2.4ssupport-triage · m.chen
Follow related activity
Inspect the available chain or correlation identifiers across actions.
Audit trail
model.call
tool.call
tool.call
model.call
Send evidence where teams work
Export the supported audit record to configured destinations.
dome — bash
dome audit query --results denied --since 24hdome audit chain act_9f2k1pdome audit stream --types tool.call,model.calldome audit export --format ocsf --since 7dIntegrations
The systems Dome composes with. SIEM, observability, incident and automation tools. Dome runs alongside what you operate: the audit trail and events land where your teams already look.
Bring identity into a request
Use a supported identity provider to verify the person behind an agent action.
Routing keyKey••••••••••••3f9a
EventsAllIncidentsCustom
TestDelivered · 202 Accepted
Retries
Send records to your operational systems
Connect audit or event delivery to a supported destination.
Search integrations
RuntimesRuntimesClientsClientsMCP serversMCPProvidersProviders
Find a supported connection
Browse runtimes, clients, tools, models, and providers by the job they support.
Webhooks
Signed events pushed to your endpoints. Subscribe to the event types you care about and receive them signed, with retries and replay. A denial reaches an on-call channel or a runbook without anyone polling.
New subscription
Send tohttps://ops.meridian.example/dome
Eventstool.calldeniedagent.suspendagent.registeragent.suspendagent.revoke
Signingwhsec_••••••a1f
Subscribe to relevant events
Choose the types of activity that should leave Dome.
POST /dome
Receivedv1,K5oZfzN95Z9UVu1…NDDrWLxs=
Computedv1,K5oZfzN95Z9UVu1…NDDrWLxs=
HMAC-SHA256 · whsec_••••a1fValid · 200
Verify the delivery
Check the event's signature at the receiving endpoint.
Delivery dlv_3b9d
quota.exhaustedops.meridianDelivered
Replayjust now200
Attempt 310:46:07503
Attempt 210:43:07503
Attempt 110:42:07503
Investigate a failed attempt
Inspect delivery status and use the supported retry or replay workflow.
dome — bash
dome webhooks subscriptions create siem \ --url https://siem.example.com/dome \ --event-type tool.call --filter 'result=denied'