Identity

These commands configure runtime Act-As: how agents prove an end-user identity on governed traffic. They do not sign operators into the Dome Platform.

A verification provider is a named OIDC or HMAC configuration. Broader-scoped providers are visible to every workspace below them. Agents, default selections, and required selections draw from that chain.

These commands require config.manage at the target scope. The CLI hides them when the active context does not carry that permission.

dome workspace verification-providers is a workspace-only convenience subset (list / create / delete). Prefer the scope-aware dome verification-providers group for reads, HMAC secret generation, and updates.

Scope and hierarchy

Reads accept --scope workspace (default), tenant, or org. Provider writes through the CLI are workspace-only. Organization providers are synchronized from the organization SSO connection in the dashboard; tenant provider writes are not available.

--include-chain applies only to a workspace-scoped list. It returns the tenant- and org-scoped providers visible to that workspace — the candidate set for agent binding and default/required selection.

Plain dome workspace verification-providers list returns workspace-owned providers only.

Default provider: nearest configured scope wins (workspace, then tenant, then organization). Required provider: broadest configured scope wins (organization, then tenant, then workspace). A required provider pins every non-bound agent below it and forces Act-As on. Bound agents remain exempt.

Tenant selections must name a tenant- or org-scoped provider. Organization selections must name an org-scoped provider. Workspace selections may name any provider visible in the workspace chain.

List providers

dome verification-providers list

List verification providers at a scope. Alias: ls.

dome verification-providers list --scope workspace --include-chain

dome verification-providers list --scope tenant
dome verification-providers list --scope org

Table columns: ID, NAME, METHOD, SCOPE, CREATED. Pass --json for the raw response.

dome workspace verification-providers list

Get provider

dome verification-providers get <provider-id>

Get one provider at its owning scope.

Human output includes method, scope, org/tenant/workspace IDs, OIDC discovery URL, and HMAC Configured (true/false). The HMAC secret is never returned.

There is no dome workspace verification-providers get.

Create provider

dome verification-providers create

Create a verification provider in the active workspace.

dome verification-providers create \
  --name google-workspace \
  --method oidc \
  --oidc-url https://accounts.google.com

dome verification-providers create \
  --name internal-signer \
  --method hmac \
  --hmac-secret "$HMAC_SECRET"

dome verification-providers create \
  --name internal-signer \
  --method hmac \
  --generate-secret

--generate-secret calls GenerateVerificationProviderSecret, threads the returned ref into create, and prints the plaintext once. It is never retrievable again. --generate-secret applies only to --method hmac and cannot be combined with --hmac-secret.

With --json and --generate-secret, the payload is {provider, secret_ref, secret_plaintext}. Store secret_plaintext immediately.

The workspace convenience command uses --oidc-discovery-url (not --oidc-url) and has no --generate-secret. Despite the flag name, pass the issuer base URL; Dome appends /.well-known/openid-configuration:

dome workspace verification-providers create \
  --name google-workspace \
  --method oidc \
  --oidc-discovery-url https://accounts.google.com

Update provider

dome verification-providers update <provider-id>

Update a workspace-scoped provider. The method is immutable. Only the flags you pass change.

There is no dome workspace verification-providers update.

Delete provider

dome verification-providers delete <provider-id>

Delete a workspace-scoped provider. Agents and scope selections that referenced it lose the binding and fail closed at the gateway until reconfigured.

dome workspace verification-providers delete <provider-id>

Workspace Act-As

Workspace Act-As is the only CLI scope that also sets the enforcement floor (--required, --allowed-methods). Tenant and org commands select providers only.

dome workspace actas get
dome workspace actas update

Both commands use the active workspace. They take no workspace-id argument.

get prints Required, Allowed Methods, Default Provider, and Required Provider.

This update is a full replace. Omitted flags clear their fields, including the provider selections. Omitting --required sets required to false.

dome workspace actas update --required --allowed-methods oidc,hmac

dome workspace actas update --default-provider {{PROVIDER_ID}}

Permission: workspace config.manage.

Tenant Act-As

dome tenant actas get
dome tenant actas update

Tenant-level default and required provider selection. There is no --required or --allowed-methods toggle at this scope.

Update is a full replace: the selection becomes exactly the flags given.

dome tenant actas get --tenant {{TENANT_ID}}
dome tenant actas update --default-provider {{PROVIDER_ID}}

Permission: tenant config.manage.

Organization Act-As

dome org actas get
dome org actas update

Organization-level default and required provider selection. The org required provider is the broadest scope, so it pins every non-bound agent in the org and forces Act-As on.

Update is a full replace.

dome org actas get --org {{ORG_ID}}
dome org actas update --required-provider {{PROVIDER_ID}}

Permission: organization config.manage.

Dashboard-only

These identity writes are not on the CLI:

An SSO connection may create a matching org-scoped OIDC verification provider when the issuer is available. That provider can be reused for Act-As. SSO still only governs Dome sign-in; the verification provider still only validates end-user identity on agent traffic.

Related commands

• dome auth login — platform session, not Act-As
• dome agents register / update — per-agent Act-As method, provider, and allow-lists
• dome callers — verified end users observed behind agent traffic
• Delegated agents — how verification and provider hierarchy resolve