> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Core concepts

> How Dome governs agents, resources, and requests

**Core concepts** explain what each Dome piece is, how the pieces fit together, and when to choose one design over another.

If you have not picked a role yet, start with [Personas](/personas) or [What is Dome?](/what-is-dome).

## How the pieces fit

Dome separates **components** you define (agents, resources, Gateways), **controls** you apply to traffic (Rules, Guards, Quotas), and **audit** that records what happened. Agents reach tools and models through a Gateway. Dome holds the upstream credentials. On each call, the controls decide what is allowed, what content may pass, and how much spend is left.

Read the concepts in this order when you want them in dependency order, from the system map down to the evidence trail.

1. **[Architecture](/concepts/architecture)** covers components, controls, audit, and the request path.
2. **[Scopes](/concepts/platform/scopes)** explains organization → tenant → workspace isolation and where configuration attaches.
3. **[Identity Patterns](/concepts/identity-patterns)** compares standing vs delegated identity before you register agents.
4. **[Agents](/concepts/agents)**, **[Resources](/concepts/resources)**, and **[Gateways](/concepts/gateways)** are the three components you define so a workload can call anything.
5. **[Rules](/concepts/controls/rules)**, **[Guards](/concepts/controls/guards)**, and **[Quotas](/concepts/controls/quotas)** are the three controls that govern traffic after admission.
6. **[Audit events](/concepts/audit)** is the evidence trail across both planes.

Add [Authorization Model](/concepts/architecture/authorization-model) or [Data plane](/concepts/architecture/dataplane) when you need Cedar semantics or runtime placement. Add [Permissions](/concepts/platform/permissions) when you need platform RBAC vs agent authorization.

## Architecture

The system map and request path.

* **[Architecture](/concepts/architecture)** explains how agents, resources, Gateways, controls, and audit relate.
* **[Authorization Model](/concepts/architecture/authorization-model)** covers Cedar permit/forbid, effective policy, and fail-closed evaluation.
* **[Data plane](/concepts/architecture/dataplane)** is the hot-path runtime that enforces configuration synced from Dome.

## Identity

Choose how an agent presents itself before you wire credentials.

* **[Identity Patterns](/concepts/identity-patterns)** compares standing identity vs delegated identity (act-as) at design time.
* **[Agent Identity](/concepts/agents/identity)** covers API keys, session tokens, and verified end-user claims on the wire.

## Components

Things you define so a workload can reach tools and models.

* **[Agents](/concepts/agents)** are the principals for auth, authorization, and audit. Lifecycle states live on [Agent Lifecycle](/concepts/agents/agent-lifecycle).
* **[Resources](/concepts/resources)** include [tools](/concepts/resources/tools), [models](/concepts/resources/models), and [pools](/concepts/resources/model-pools). Dome stores upstream credentials. Agents never hold them.
* **[Gateways](/concepts/gateways)** package membership and agent grants behind one URL. [Tools gateway](/concepts/gateways/tools-gateway) and [LLM gateway](/concepts/gateways/llm-gateway) are the MCP and model ingresses on that URL, not separate Gateway types.

## Controls

Things you apply after a call is admitted.

* **[Rules](/concepts/controls/rules)** are scoped Cedar bundles that authorize what an agent may do.
* **[Guards](/concepts/controls/guards)** inspect content on request and response paths.
* **[Quotas](/concepts/controls/quotas)** cap spend over a window, including pool spillover.

## Platform

Boundaries for tenancy and who may administer Dome.

* **[Scopes](/concepts/platform/scopes)** define the organization, tenant, and workspace hierarchy.
* **[Permissions](/concepts/platform/permissions)** cover platform RBAC for people and API clients. This layer is separate from Cedar for agents.

## Audit

Evidence after configuration and runtime decisions.

* **[Audit events](/concepts/audit)** is one trail across configuration changes and runtime decisions.
* **[Webhooks](/concepts/audit/webhooks)** deliver signed copies of selected events to your endpoints.

## Next steps

With that map of Dome's pieces in mind, continue with:

* [Connect](/connect) to register agents, attach resources, and grant Gateway access.
* [Govern](/govern) to write Rules, assign Guards, and set Quotas.
* [Operate](/operate) to investigate audit events, stream live events, and subscribe to webhooks.
* [Develop](/develop) to send credentials, Gateway URLs, and Act-As claims from the application.