dome verification-providers

dome verification-providers manages the named OIDC and HMAC configurations Dome verifies an Act-As assertion against. An agent bound to a provider may act for a person, and the Gateway checks every such call against that provider before authorizing it.

Set up alongside dome callers: providers are what you configure, callers are the end users those providers turned out to verify.

Every command requires config.manage at the target scope, and the CLI hides them when the active context does not carry it. Alias: list = ls.

Scope

Reads accept --scope workspace (default), tenant, or org. Writes are workspace-only: organization providers are synchronized from the dashboard SSO connection, and tenant-scoped writes are not exposed yet.

A provider is visible to every workspace beneath the scope that owns it. That visible set is what an agent binding or a scope selection may name.

Setting up SSO can leave you a provider you did not create: when the issuer is available, the connection also creates a matching org-scoped OIDC provider, and Act-As can reuse it.

dome workspace verification-providers is a workspace-only convenience subset (list / create / delete), documented on dome workspace. Prefer the scope-aware group here for reads, updates, and HMAC secret generation.

Act-As provider selection

Creating a provider makes it available at its scope. The Act-As commands select which available provider agents use by default or must use.

• Default provider: the nearest configured scope wins: workspace, then tenant, then organization.
• Required provider: the broadest configured scope wins: organization, then tenant, then workspace. It forces Act-As and pins every non-bound agent beneath that scope to the selected provider.

All three update commands use full-replace semantics. The resulting selection contains exactly the provider flags you pass; omitting a provider flag clears that field.

Workspace Act-As

dome workspace actas get [workspace-id-or-slug]
dome workspace actas update [workspace-id-or-slug]

Get or update the Act-As policy and provider selection for a workspace. The workspace defaults to the active context.

Workspace updates replace the complete policy. Omitted flags clear provider selections and allowed methods; omitting --required sets it to false. Pass the full intended state each time.

Refer to dome workspace for the complete workspace command reference.

Tenant Act-As

dome tenant actas get
dome tenant actas update \
  --default-provider {{PROVIDER_ID}} \
  --required-provider {{PROVIDER_ID}}

Get or update the provider selection for a tenant. The provider must be owned by that tenant or its organization.

Tenant scope does not set --required or --allowed-methods. A required provider itself forces Act-As for non-bound agents beneath the tenant.

Refer to dome tenant for the dedicated command-group reference.

Organization Act-As

dome org actas get
dome org actas update \
  --default-provider {{PROVIDER_ID}} \
  --required-provider {{PROVIDER_ID}}

Get or update the provider selection for an organization. The provider must be owned by that organization.

An organization-level required provider applies to every non-bound agent in the organization and overrides required selections at tenant or workspace scope.

Refer to dome org for the dedicated command-group reference.

List providers

dome verification-providers list

List providers at a scope. Columns are ID, NAME, METHOD, SCOPE, and CREATED; pass --json for the raw response.

dome verification-providers list --scope workspace --include-chain

dome verification-providers list --scope tenant
dome verification-providers list --scope org

Get provider

dome verification-providers get <provider-id>

Get one provider at its owning scope. Output covers method, scope, org, tenant and workspace IDs, the OIDC discovery URL, and HMAC Configured as true or false. The HMAC secret is never returned.

Create provider

dome verification-providers create

Create a provider in the active workspace.

dome verification-providers create \
  --name google-workspace \
  --method oidc \
  --oidc-url https://accounts.google.com

dome verification-providers create \
  --name internal-signer \
  --method hmac \
  --hmac-secret "$HMAC_SECRET"

dome verification-providers create \
  --name internal-signer \
  --method hmac \
  --generate-secret

--generate-secret prints the plaintext once and it is never retrievable again. With --json, the payload is {provider, secret_ref, secret_plaintext} — store secret_plaintext immediately.

Update provider

dome verification-providers update <provider-id>

Update a workspace-scoped provider. Only the flags you pass change, and the method is immutable.

Delete provider

dome verification-providers delete <provider-id>

Delete a workspace-scoped provider.

Agents and scope selections that named the provider lose that binding and fail closed at the Gateway until another provider resolves. Refer to Delegated agents for how a binding resolves.