Agent Operations Platform
Model Broker
Dome's model router. It takes OpenAI- and Anthropic-compatible calls at /v1/*, evaluates policy, routes to a provider or a pool, and injects the provider credential at egress. The agent's call shape never changes.
Workflow
Connect a provider.Then the next.
The same loop for every upstream. Configure it, pool it if you want failover, authorize the agent.
- 01
Configure
Add a model provider — Anthropic, OpenAI, Bedrock and more — and have credentials securely stored.
- 02
Route
Optionally group providers into a pool. Failover, cost routing, region pinning — invisible to the agent.
- 03
Authorize
Write rules at the right scope. Grant an agent specific models, model IDs, or pools.
- 04
Evaluate
Every model call evaluated against policy, credentials injected at egress, recorded with uniform llm.* audit.
Consistent operations
How every model call lands
Cost, data egress and provider choice all converge on model traffic. One place governs all three, whichever provider is on the other end.
Agent calls /v1/* with its Dome token. Wire format is OpenAI- or Anthropic-compatible.
Rules evaluate: which agent, which model, what classification, which scope.
Direct to a provider, or through a pool with match-when predicates.
Provider credential injected at egress. Response normalized back to the agent.
Provider abstraction
OpenAI- and Anthropic-compatible wire formats at /v1/*. Anthropic, OpenAI, Bedrock, Vertex, or a server you host yourself, with no change to client code.
Routing strategy
Direct to a provider, or through a pool: failover, region-pinned, cost-cascaded, or routed on the verified person the agent is acting for. The agent sees none of it.
Spend & posture
Dollar caps on six subjects: workspace, agent, verified person, pool, model, gateway. One llm.* audit vocabulary across every provider, so a single query reconstructs spend and decisions.
Options
What the Broker lets you do
What you can configure per connection and per pool, from the CLI, the API, or Terraform.
Identity-aware routing
Pool selection can read the verified person behind the call: their roles, groups, or directory claims. An unverified assertion never matches, so the fail-safe direction is away from the privileged pool.
Failover and cascade
A pool with ordered priority tries the next member on a rate limit, an outage, or a capacity error, inside the same call. Cascades work the same way — try haiku, escalate on retry — and each candidate is authorized in its own right.
Region pinning
Tag connections with attributes and select on them. EU traffic stays on EU endpoints.
Spend caps and budget routing
Daily or monthly dollar limits against a workspace, agent, person, pool, model, or gateway, applied per caller where you want each one held to the same ceiling. A pool can also prefer its cheapest member and spill to the next when that budget runs out.
Guards on model traffic
The filters that govern tool responses work on model calls in both directions: the outbound prompt before it reaches the provider, the completion before it reaches the caller. Streaming and non-streaming alike.
Per-user provider credentials
A connection can dispatch with each caller's own provider credential instead of a shared workspace key. Provider-side attribution and per-seat entitlements survive the hop.
In practice
From provider to governed call
Configure a provider, pool it, guard the boundary, authorize the agent. Client code is unchanged and points at the Broker URL.
dome model add anthropic-prod \
--provider anthropic \
--model claude-sonnet-5 \
--auth-method api-key \
--credential-type shared
dome model pool create cheap-reasoning \
--match-when '{"request.model":["claude-haiku-4-5","gpt-5-mini"]}'
dome model pool member add cheap-reasoning anthropic-prod
dome rules apply models/cheap-reasoning.cedardome guards filters create pii-redact \
--redact-ssn \
--redact-substring "internal-only" \
--block-substring "TOP-SECRET"
# The completion, before the agent sees it
dome model guards filters set anthropic-prod \
--direction response --filters pii-redact
# The prompt, before it leaves your perimeter
dome model guards filters set anthropic-prod \
--direction request --filters pii-redactThe request direction is the underused half. It sees the prompt before it leaves your perimeter, so a customer identifier or an internal marker never reaches the provider at all. Model connections take text filters: substrings, US SSN patterns, Luhn-checked card numbers, phone numbers, and N-digit patterns.
client = anthropic.Anthropic(
base_url="https://broker.dome.example.com/v1",
api_key=os.environ["DOME_AGENT_TOKEN"],
)
response = client.messages.create(
model="claude-sonnet-5",
messages=[...],
)
Registry
Gateway
ManagementQuestions
Common questions about model routers
What is a model router?
A model router is one endpoint in front of every model provider an agent can call. Dome's Model Broker accepts OpenAI- and Anthropic-compatible calls at /v1/*, evaluates policy, routes to a provider or a pool, and injects the provider credential at egress.
Do we have to change agent code to route through the Broker?
No. The client points at the Broker URL instead of the provider's, and the call shape stays the same. Dome handles policy, routing, and credentials from there.
What happens when a model provider fails or rate-limits?
Providers can be composed into a pool, so model traffic has somewhere to fail over to without the agent knowing which upstream served the call.
Do agents ever hold model provider API keys?
No. The provider credential is injected at egress, at the Broker. The agent never holds the key for the provider it is calling.
Why route all model traffic through one place?
Cost, data egress, and provider choice all converge on model traffic. The Broker is the one place they are governed consistently, regardless of which provider is on the other end of the call.