Dome Platform Entities

The registered identity of an agent.

Name, owner, declared capabilities, and a lifecycle that runs provisioned, active, suspended, revoked. The credential issued at registration is the root of trust for every call that follows, which is what makes revoking an agent a single action rather than a hunt across systems.

The person an agent is acting for.

Asserted per request on a header and verified before it becomes an identity — by OIDC or HMAC, configured per agent. Once verified, a rule can name the caller as well as the agent, and the audit record names both. An agent can be required to always act for someone, so unattended calls are refused.

A connection to something an agent can call.

An MCP server, a REST API described by OpenAPI, or a first-party internal service. Tools surface into a catalog that policy filters per agent, so an agent that may not call a tool does not see it in discovery — it gets a shorter list rather than a forbidden entry.

The named access surface you create and grant.

A Gateway composes tools, tool sources and model pools into one endpoint an agent is granted as a unit. Gateways are logical rather than physical, so you create as many as the shape of your estate needs. A resource that sits in no Gateway is unreachable — a valid state, not an error.

A connection to a model provider.

Anthropic, OpenAI, Bedrock, Vertex, Azure OpenAI, or any OpenAI-compatible endpoint including a self-hosted one. The provider credential lives with the connection and is injected at egress, so the agent never holds it.

A named group of models with a routing strategy.

Priority and weight decide which member serves a request, and failover falls through on rate limits or outages. Each candidate is authorized in its own right rather than inheriting the first choice's permission, so failover cannot quietly route around policy.

Policy evaluated at the call boundary.

A rule permits or forbids a call before it runs. Written at four scopes — org, tenant, workspace, agent — fail-closed, with forbid winning over any permit. Conditions can reference any other entity, including the caller an agent is acting for. Simulate a decision before you ship the rule. The policy engine is Cedar.

Inspection and filtering of what comes back.

Classify, redact or constrain a tool or model response before the agent ever sees it, so a permitted call cannot return data the caller should not have. Versioned with rollback, and assigned per connection in either direction.

Spend and usage ceilings bound to an identity.

Bound to an agent, workspace or tenant rather than to an API key — which is what makes attribution and containment possible without reconciling two systems by hand. Enforced per scope, with the denial recorded like any other decision.

The immutable event trail.

One vocabulary across every entity: agent, caller chain, target, arguments, rule version, outcome. Because tool calls and model calls share it, reconstructing what an agent did is one query rather than a join across two systems.

The same vocabulary, live.

The estate as it happens rather than after the fact — useful for watching a policy change land, or for catching a denial while the person who triggered it is still on the call.

Where the record goes.

Identity providers, secrets stores, SIEM, APM and CI/CD. Dome composes with what you already run rather than replacing it, and webhook subscriptions push events out as they happen.

The scope hierarchy everything sits inside.

Organization, tenant and workspace — the levels rules are written against and the boundary that isolates one team's estate from another's.

The people who operate Dome.

Roles and workspace membership, federated from the identity provider you already run. Distinct from Callers: a user administers the platform, a caller is who an agent is acting for.