Security — agent instructions

Machine-readable instructions for an AI agent running the Security role tutorial

These are the instructions an AI agent follows to run the Security tutorial on your behalf. Read the tutorial instead if you are running the steps yourself.

Goal

Stand up role-sec-agent in sandbox-role-security, apply redact-contact, deploy restrictive Cedar, hand the user curl/Python verify (allow/redact/deny), then audit query + export.

Rules

Confirm before you start. Present the plan and wait for proceed.
Narrate as you go. One or two sentences before each step.
Sandbox only. Confirm workspace starts with sandbox-.
Never print the agent token. Write to a gitignored .env.
Hand off verify. Do not call governed tools yourself to demo.
Link the console after create/grant/deploy.
Show evidence. Never report done without command output.

Quick setup

Here's what I'll do for the Security role tutorial.

1. Provision sandbox-role-security
2. Register role-sec-agent, attach demo-hr, grant Default
3. Create and assign redact-contact Filter
4. Validate, simulate, deploy Cedar (directory allow; salary deny)
5. Hand you curl/Python verify (allow, redact, deny)
6. Audit query + export, then offer clean up

Shall I proceed?

Steps

1. Provision sandbox

dome sandbox provision --scope=workspace --workspace-name role-security
dome context sync
dome context use sandbox-role-security
dome context current

2. Substrate

dome agents register --name role-sec-agent --if-not-exists
dome agents create-key role-sec-agent --name service

Write token to .env only.

dome tool add \
  --name demo-hr \
  --url https://demo-mcp.domesystems.ai/mcp \
  --protocol streamable-http \
  --auth-method none \
  --gateway Default
dome gateway access grant Default role-sec-agent

3. Filter

Write redact-contact.json and run create + dome tool guards filters set exactly as in the human tutorial.

4. Cedar

Write role-sec-agent.cedar, then:

dome rules validate role-sec-agent.cedar
dome rules simulate --agent role-sec-agent --action mcp:call \
  --resource demo-hr/hr/list_employees --resource-type mcp_tool
dome rules simulate --agent role-sec-agent --action mcp:call \
  --resource demo-hr/finance/get_salary --resource-type mcp_tool
dome rules apply role-sec-agent.cedar --agent role-sec-agent --name role-sec-agent

Expect ALLOW then DENY on simulate.

5. Hand off verify

Hand the user Verify allow, redact, and deny.

6. Audit + export

dome audit query --limit 20
dome audit query --results denied --limit 10
dome audit export --since "$(date -u +%Y-%m-%dT00:00:00Z)" --format jsonl > security-audit.jsonl

7. Clean up (optional)

dome workspace delete sandbox-role-security

Security — agent instructions

On this page