Know who every agent acts for.
Access authenticates the agent, verifies the person it acts for, and carries both identities into every decision and every record.
What you can do
dome_ak_…4f91→token per calldome_tk_7a1cdome_tk_3f90dome_tk_c41e10 min
Give every agent a key
Issued at registration and exchanged for a short-lived token on every call.
Verify callerOIDCHMAC
Issuerokta.meridian.example
Subjectmaya.patel
SignatureRS256 · valid
X-Dome-Act-Asmaya.patel
Signaturev1=9f2c…e81a
Shared secretmatched
Verified · maya.patel
Verify the caller
OIDC from your identity provider, or a signed HMAC assertion where a service can't forward a token.
refunds.cedar
permit (principal, action, resource)when { principal.agent == "support-agent" && context.caller.groups.contains("finance")};
waiting for a callmaya.patelgroups: supportDenyj.ortizgroups: financeAllow
Name the caller in a rule
Rules read the person's roles, groups and claims, not only the agent's.
prod-gateway
Require a verified caller
support-agentj.ortizAllow
batch-agentno callerRefused
support-agentmaya.patelAllow
Require a person
Refuse any call that arrives without a verified caller.
DKd.kimOktaActiveDeactivated
Acting for d.kim
support-agentRunningStopped
report-writerRunningStopped
triage-botRunningStopped
Offboard at the call
When your directory marks someone as gone, every agent acting for them stops.
support-assistantforMPmaya.patel
zendesk
X-Dome-Callermaya.patel
audit
callermaya.patel
Carry identity onward
The backend and the audit record both see who the call was for.
Every decision sees the agentand the person it acts for.
The agent proves who it is and says who it acts for. Dome verifies both before any rule runs.
Authenticate
The agent presents its own credential.
support-assistantRegistered agentPOST /mcpBearer dome_ak_…4f91DomeAgent identitysupport-assistantVerifiedAssert
It names the person it acts for on the X-Dome-Act-As header.
POST /mcpsupport-assistantAuthorizationBearer dome_ak_…4f91X-Dome-Act-Asmaya.patel@meridian.exampleMPOne request · two identitiesAssertedVerify
Dome checks the assertion. An unverified one never becomes an identity.
AssertedIdentitiesMPmaya.patelOIDCVerifiedTBtyler.brooksHMACVerifiedDKd.kimOIDCExpiredPropagate
Both identities reach the rule, the audit record and the upstream call.
Domesupport-assistantMPmaya.patelRulezendesk.cedarAllowsupport-assistant · maya.patelAudittool.callRecordedagent + caller, both named
UpstreamzendeskX-Dome-Caller: maya.patel
Talk with ourFDE team.
Or start free, and register your first agent in minutes.
Talk with our FDE team
Our engineers design, build and run governed agents for the part of your business you want to change. You see what they deliver.
Start free
No card required to start. Register your first agent in minutes.