Workspace Lifecycle
List
dome workspace list
List workspaces in the active tenant. Aliases: ls.
Create
dome workspace create
Create a new workspace.
Get
dome workspace get <id-or-slug>
Get workspace details. The output includes the configured Freshness Window — how long the gateway may serve cached policy for the workspace before failing closed.
Delete
dome workspace delete <id-or-slug>
Delete a workspace permanently.
Members
Members list
dome workspace members list [workspace-id-or-slug]
List workspace memberships.
Members set
dome workspace members set [workspace-id-or-slug]
Set a user’s role in a workspace.
Members remove
dome workspace members remove [workspace-id-or-slug]
Remove a user’s workspace membership. If the user has active API keys, an interactive picker prompts you to select which to revoke; pass --revoke-all-keys or --revoke-keys to skip the prompt.
Act-As Enforcement
Actas get
dome workspace actas get [workspace-id-or-slug]
Get the act-as enforcement policy.
Actas update
dome workspace actas update [workspace-id-or-slug]
Update the act-as enforcement policy.
Policy Freshness Window
Each workspace has a configurable freshness window that bounds how long the gateway may serve cached authorization policy for that workspace before failing closed. Default is 90 seconds; allowed range is 30–86400 seconds. Enforcement is per-workspace — one workspace failing closed does not affect others.
dome workspace set-freshness-window <seconds> [workspace-id-or-slug]
Set the freshness window (in seconds) for a workspace.
Once the window elapses, the gateway returns access_denied for every request in that workspace and emits a authorization.staleness_rejected audit event until the workspace’s policy is fresh again.
Verification Providers
Verification-providers list
dome workspace verification-providers list [workspace-id-or-slug]
List verification providers.
Verification-providers create
dome workspace verification-providers create [workspace-id-or-slug]
Create a verification provider.
Verification-providers delete
dome workspace verification-providers delete <provider-id> [workspace-id-or-slug]
Delete a verification provider.
