Core concepts

Core concepts explain what each Dome piece is, how the pieces fit together, and when to choose one design over another. If you have not picked a role yet, start with Personas or What is Dome?.

​

How the pieces fit

Dome separates components you define (agents, resources, Gateways), controls you apply to traffic (Rules, Guards, Quotas), and audit that records what happened. Agents reach tools and models through a Gateway. Dome holds the upstream credentials. On each call, the controls decide what is allowed, what content may pass, and how much spend is left. Read the concepts in this order when you want them in dependency order, from the system map down to the evidence trail.

1. Architecture covers components, controls, audit, and the request path.
2. Scopes explains organization → tenant → workspace isolation and where configuration attaches.
3. Identity Patterns compares standing vs delegated identity before you register agents.
4. Agents, Resources, and Gateways are the three components you define so a workload can call anything.
5. Rules, Guards, and Quotas are the three controls that govern traffic after admission.
6. Audit events is the evidence trail across both planes.

Add Authorization Model or Data plane when you need Cedar semantics or runtime placement. Add Permissions when you need platform RBAC vs agent authorization.

​

Architecture

The system map and request path.

• Architecture explains how agents, resources, Gateways, controls, and audit relate.
• Authorization Model covers Cedar permit/forbid, effective policy, and fail-closed evaluation.
• Data plane is the hot-path runtime that enforces configuration synced from Dome.

​

Identity

Choose how an agent presents itself before you wire credentials.

• Identity Patterns compares standing identity vs delegated identity (act-as) at design time.
• Agent Identity covers API keys, session tokens, and verified end-user claims on the wire.

​

Components

Things you define so a workload can reach tools and models.

• Agents are the principals for auth, authorization, and audit. Lifecycle states live on Agent Lifecycle.
• Resources include tools, models, and pools. Dome stores upstream credentials. Agents never hold them.
• Gateways package membership and agent grants behind one URL. Tools gateway and LLM gateway are the MCP and model ingresses on that URL, not separate Gateway types.

​

Controls

Things you apply after a call is admitted.

• Rules are scoped Cedar bundles that authorize what an agent may do.
• Guards inspect content on request and response paths.
• Quotas cap spend over a window, including pool spillover.

​

Platform

Boundaries for tenancy and who may administer Dome.

• Scopes define the organization, tenant, and workspace hierarchy.
• Permissions cover platform RBAC for people and API clients. This layer is separate from Cedar for agents.

​

Audit

Evidence after configuration and runtime decisions.

• Audit events is one trail across configuration changes and runtime decisions.
• Webhooks deliver signed copies of selected events to your endpoints.

​

Next steps

With that map of Dome’s pieces in mind, continue with:

• Connect to register agents, attach resources, and grant Gateway access.
• Govern to write Rules, assign Guards, and set Quotas.
• Operate to investigate audit events, stream live events, and subscribe to webhooks.
• Develop to send credentials, Gateway URLs, and Act-As claims from the application.