Bring every agent under management.Dome is GA.

Start free
Dome Systems

Agent Operations Platform

Agent Registry

Every agent gets a record: a name, an owner, a workspace, and the credential every call after it flows from. Built in-house or bought from a vendor, the lifecycle is the same — provisioned, active, suspended, revoked.

Read the docs
dome — registry

Workflow

Register the first.Then the fiftieth.

The same loop for every agent. Each step is one CLI command, one API call, or one line of declarative state in CI.

  1. 01

    Register

    Create the registry record. Name, owner, workspace. Receive an API key.

  2. 02

    Provision

    Declare the tools and models the agent is intended to use. Capabilities are scoped at the workspace.

  3. 03

    Enable

    Move from provisioned to active. The agent can now reach its declared surface — subject to policy.

  4. 04

    Observe

    Watch the audit stream. Tighten rules as patterns emerge. Suspend or revoke from the same surface.

Consistent operations

Standard agent lifecycle

Code becomes an object the platform can name. The record carries the credential, the call context, and the accountability chain across every hop.

Provisioned

Record created. API key issued. No traffic yet.

Active

Calls flow through Gateway and Broker, subject to policy.

Suspended

Access halts within seconds. Audit retains everything.

Revoked

Credential dead. Record retained for compliance.

Registration

An immutable record: name, owner, workspace. The key issued here becomes a short-lived token on every call, and everything else flows from it.

Credential chain

An agent can act for a person, or for another agent. The chain is signed end to end and auditable per hop, following the OAuth 2.0 Token Exchange model.

Call context

Every call carries the record, the act-as claims, the headers, and policy metadata. That is what the Gateway and Broker evaluate.

Options

What the Registry lets you do

Six knobs on the record, set at registration or any time after.

Scoped grants

Grant the tools, pools, models and gateways an agent may reach. Anything ungranted is unreachable, and it does not appear in discovery.

Key rotation without downtime

An agent holds up to four active keys, so a rotation is issue-then-retire. Revoke any one of them by name.

Short-lived call credentials

The long-lived key never travels on a call. It exchanges for a token that lasts ten minutes by default, tunable per agent from one minute to a day.

Act-as enforcement

Require every call to carry a verified person. The Gateway and Broker fail closed without one.

Liveness

Agents heartbeat. The first one moves an agent from provisioned to active, and an agent that stops reporting is marked stale.

Lifecycle controls

Suspend or revoke, with an optional cascade to child agents. Revocation kills the credential and keeps the record; a hard delete is a separate act.

In practice

From CLI to running agent

Register from the CLI, the API, or a CI pipeline. The SDK takes the issued key from there.

Register from the CLIbash
dome agents register \
  --name support-triage \
  --tool zendesk/create_ticket \
  --pool prod-models \
  --actas-required \
  --actas-method oidc

dome agents create-key support-triage --name ci
Use the agent credential in codepython
import dome

client = dome.DomeClient(dome.DomeConfig(
    base_url="https://api.dome.example.com",
    token="dome_at_...",   # agent API key
))
client.start()

client.check(
    tool="zendesk/create_ticket",
    on_allow=lambda d: ...,
    on_deny=lambda req, reason: ...,
)