> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# dome rules

> Deploy, validate, simulate, and rollback authorization rules

| Command               |                                   |
| --------------------- | --------------------------------- |
| [Apply](#apply)       | `dome rules apply [files...]`     |
| [List](#list)         | `dome rules list`                 |
| [Show](#show)         | `dome rules show`                 |
| [Validate](#validate) | `dome rules validate [files...]`  |
| [Rollback](#rollback) | `dome rules rollback <bundle-id>` |
| [Generate](#generate) | `dome rules generate`             |
| [Simulate](#simulate) | `dome rules simulate`             |

***

## Apply

`dome rules apply [files...]`

Deploy a rule bundle from one or more Cedar files.

```bash theme={"system"}
dome rules apply rules.cedar [flags]
```

| Flag            | Type   | Description                                                                                        |
| --------------- | ------ | -------------------------------------------------------------------------------------------------- |
| `--agent`       | string | Agent name or ID — deploy rules scoped to this agent                                               |
| `--name`        | string | Friendly name for the rule bundle                                                                  |
| `--court-scope` | string | Directional [Court-review marker](/govern/judges): `none` (default), `reduce`, `expand`, or `both` |

After a successful deploy, `apply` prints advisory `warning:` lines to
stderr for any `Dome::MCPTool` reference that does not match a tool in
the target workspace's persisted MCP tool catalog (typo, rename, or a
tool not yet observed). Warnings never block the deploy.

## List

`dome rules list`

List rule bundle history.

| Flag      | Type   | Description                                        |
| --------- | ------ | -------------------------------------------------- |
| `--agent` | string | Agent name or ID — list rules scoped to this agent |
| `--limit` | int    | Maximum results (default: 20)                      |

## Show

`dome rules show`

Show effective rules across the full scope hierarchy.

| Flag      | Type   | Description                                        |
| --------- | ------ | -------------------------------------------------- |
| `--agent` | string | Agent name or ID — show rules scoped to this agent |

## Validate

`dome rules validate [files...]`

Validate Cedar rule files without deploying. Returns errors and prints catalog warnings (unknown tools or connections) to stderr. Pass `--agent` to run catalog checks against an agent's scope — without it, only syntax and semantic validation runs.

```bash theme={"system"}
dome rules validate rules.cedar [flags]
```

| Flag      | Type   | Description                                                |
| --------- | ------ | ---------------------------------------------------------- |
| `--agent` | string | Agent name or ID — validate rules against this agent scope |

## Rollback

`dome rules rollback <bundle-id>`

Rollback to a previous rule bundle. The bundle UUID (from `dome rules list`) encodes the scope — no extra flags needed.

## Generate

`dome rules generate`

Generate starter Cedar authorization rules.

| Flag           | Type   | Description                              |
| -------------- | ------ | ---------------------------------------- |
| `--from-tools` | bool   | Generate rules based on registered tools |
| `--output`     | string | Write rules to file (default: stdout)    |

## Simulate

`dome rules simulate`

Simulate an authorization decision against active rules.

| Flag              | Type      | Required | Description                                                  |
| ----------------- | --------- | -------- | ------------------------------------------------------------ |
| `--agent`         | string    | Yes      | Agent ID or name                                             |
| `--action`        | string    | Yes      | Action to evaluate (e.g., `mcp:call`)                        |
| `--resource`      | string    | Yes      | Resource identifier                                          |
| `--resource-type` | string    | No       | `mcp_tool`, `llm_model`, or `resource` (default: `mcp_tool`) |
| `--eval-context`  | key=value | No       | Evaluation context key-value pairs (repeatable)              |
| `--actas-sub`     | string    | No       | Act-as subject identifier                                    |
| `--actas-email`   | string    | No       | Act-as email                                                 |
| `--actas-roles`   | string    | No       | Act-as roles (comma-separated)                               |
| `--actas-groups`  | string    | No       | Act-as groups (comma-separated)                              |