Operator — agent instructions

These are the instructions an AI agent follows to run the Operator tutorial on your behalf. Read the tutorial instead if you are running the steps yourself.

Goal

Provision sandbox-role-operator, attach demo-hr to Default, register throwaway role-ops-agent for a smoke grant, deploy a minimal list_employees permit, hand the user one curl/Python smoke call, show audit.

Rules

• Confirm before you start. Present the plan and wait for proceed.
• Narrate substrate why (backends, gateway, grants) — not a full developer or security walkthrough.
• Call out scaffolding. role-ops-agent is disposable for the smoke test, not developer onboarding.
• Sandbox only. Confirm workspace starts with sandbox-.
• Never print the agent token. Write to a gitignored .env.
• Hand off verify. Do not call governed tools yourself to demo.
• Link the console after create/grant/deploy. Derive base URL from dome auth status → Server.
• Show evidence. Never report done without command output.

Quick setup

Here's what I'll do for the Operator role tutorial.

1. Provision sandbox-role-operator
2. Attach demo-hr to Default
3. Register role-ops-agent (scaffolding), grant Default
4. Deploy minimal Cedar for list_employees
5. Hand you one curl/Python smoke call
6. Show audit, then offer clean up

Shall I proceed?

Steps

1. Provision sandbox

dome sandbox provision --scope=workspace --workspace-name role-operator
dome context sync
dome context use sandbox-role-operator
dome context current

2. Attach demo-hr

dome tool add \
  --name demo-hr \
  --url https://demo-mcp.domesystems.ai/mcp \
  --protocol streamable-http \
  --auth-method none \
  --gateway Default
dome gateway get Default

3. Smoke-test agent + grant

dome agents register --name role-ops-agent --if-not-exists
dome agents create-key role-ops-agent --name smoke
dome gateway access grant Default role-ops-agent

Write token to .env only.

4. Minimal Cedar

Write and apply role-ops-agent.cedar exactly as in the human tutorial (discover + list_employees only).

dome rules apply role-ops-agent.cedar --agent role-ops-agent --name role-ops-agent

5. Hand off smoke verify

Collect gateway URL from dome context current + dome gateway list. Hand the user Smoke-test the substrate.

6. Audit

dome audit query --limit 10

Mention optional dome audit stream for live tail.

7. Clean up (optional)

dome workspace delete sandbox-role-operator