Dome Platform Resources

The registered identity of an agent.

Name, owner, declared capabilities, and a lifecycle that runs provisioned, active, suspended, revoked. The credential issued at registration is the root of trust for every call that follows. Revoke the agent and every call stops.

dome agents register --name support-triage

dome agents list
dome agents suspend support-triage

The person an agent is acting for.

Asserted per request on a header and verified before it becomes an identity — by OIDC or HMAC, configured per agent. Once verified, a rule can name the caller as well as the agent, and the audit record names both. An agent can be required to always act for someone, so unattended calls are refused.

dome agents update support-triage \
  --actas-required \
  --actas-method oidc

A connection to something an agent can call.

An MCP server, a REST API described by OpenAPI, or a first-party internal service. Tools surface into a catalog that policy filters per agent, so an agent that may not call a tool does not see it in discovery — it gets a shorter list rather than a forbidden entry.

dome tool add --name zendesk \
  --url https://mcp.zendesk.example.com \
  --protocol streamable-http \
  --auth-method oauth

dome tool catalog list zendesk

The named access surface you create and grant.

A Gateway composes tools, tool sources and model pools into one endpoint an agent is granted as a unit. Gateways are logical rather than physical, so you create as many as the shape of your estate needs. A resource that sits in no Gateway is unreachable — a valid state, not an error.

dome gateway create support-prod
dome gateway tool-sources add support-prod zendesk
dome gateway model-pools add support-prod prod-models
dome gateway access grant support-prod support-triage

A connection to a model provider.

Anthropic, OpenAI, Bedrock, Vertex, Azure OpenAI, or any OpenAI-compatible endpoint including a self-hosted one. The provider credential lives with the connection and is injected at egress, so the agent never holds it.

dome model add anthropic-prod \
  --provider anthropic \
  --model claude-sonnet-5

A named group of models with a routing strategy.

Priority and weight decide which member serves a request, and failover falls through on rate limits or outages. Each candidate is authorized in its own right rather than inheriting the first choice's permission, so failover cannot quietly route around policy.

dome model pool create prod-models \
  --routing-strategy priority_weighted

dome model pool member add prod-models anthropic-prod --priority 0

Policy evaluated at the call boundary.

A rule permits or forbids a call before it runs. Written at four scopes — org, tenant, workspace, agent — fail-closed, with forbid winning over any permit. Conditions can reference any other resource, including the caller an agent is acting for. Simulate a decision before you ship the rule. The policy engine is Cedar.

permit (
  principal == Dome::Agent::"support-triage",
  action    == Dome::Action::"mcp:call",
  resource  == Dome::MCPTool::"zendesk/update_ticket"
) when {
  principal has act_as &&
  resource.arguments.requester == principal.act_as.email
};

Inspection and filtering of content in flight.

Classify, redact or constrain a tool or model response before the agent ever sees it, so a permitted call cannot return data the caller should not have. Versioned with rollback, and assigned per connection in either direction.

dome guards filters create pii-redact \
  --config-from pii.json

dome tool guards filters set zendesk \
  --direction response --filters pii-redact

Spend and usage ceilings bound to an identity.

Bound to an agent, workspace or tenant, not to an API key. Attribution comes free. Enforced per scope, with the denial recorded like any other decision.

dome model quota set \
  --subject agent \
  --agent support-triage \
  --limit 2000000 \
  --window 24h

The event trail, after the fact and live.

One vocabulary across every resource: agent, caller chain, target, arguments, rule version, outcome. Tool calls and model calls share it. Reconstructing what an agent did is one query. The same trail streams live, for the denial that lands while the person who triggered it is still on the call.

dome audit query
dome audit chain act_9f2k1p

dome audit stream

Signed events pushed to your endpoints.

A subscription selects the event types you care about and delivers them signed, with retries and replay. The audit trail as a push, not a pull. A denial reaches an on-call channel or a SOAR runbook without anyone polling for it.

dome webhooks subscriptions create siem \
  --url https://siem.example.com/dome \
  --event-type tool.call --filter 'result=denied'

The systems Dome composes with.

Identity providers, secrets stores, and audit export destinations. Dome runs alongside what you already operate rather than replacing it — the identity provider stays the identity provider, the secrets store stays the secrets store, and the audit record lands where your evidence already lives.

dome integrations list

AI assistance over the platform itself.

The Rules assistant drafts, validates and refines Cedar from the dashboard, so authoring policy does not require fluency in the policy language on day one. Whatever it produces goes through the same validation and simulation path as a hand-written rule — the assistant drafts, it does not deploy.

dome rules validate ./rules/support-triage.cedar

dome rules simulate --agent support-triage \
  --action mcp:call --resource zendesk/delete_ticket