> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Judges

> Hidden — Judges / Intelligent Authorization audit trail, event catalog, and rename notes. Not shipping.

**Judges** (Intelligent Authorization / The Court) holds the audit and event contract for Court deliberation when Cedar returns `no_match`.

## Where Court evidence lands

Success events (rulings, Court configuration changes, permission denies) land on the **customer workspace** audit trail with the rest of that workspace's evidence.

Outbound LLM calls The Court makes while deliberating land as `llm.*` events on the **platform judges workspace** trail under the LLM gateway. Investigators looking for "what did the Court decide for this agent?" stay on the customer trail. Questions about "which models did Court call?" belong on the platform judges workspace.

## Rename (`moot.*` → `judges.*`)

Renamed from Moot in the 2026-06 release. Audit rows written before the cutover keep their original event-type strings (`moot.*`) and remain readable, queryable, and typed. The registry carries read-path aliases that resolve them to the same payload shape. All new rows write `judges.*`. Update saved queries and dashboards to the new prefix.

Permissions (`moot.view` / `moot.manage`), CLI (`dome moot`), MCP (`dome_moot_*`), the `Moot` Connect service, and `Decision.depth` `"intelligent"` are a hard rename to `judges` with no alias.

## Audit v1 event types

### Governing

| Type                              | Description                                                                                                                                                                                                                                                                 |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `judges.deliberation.attempted`   | Court deliberation started                                                                                                                                                                                                                                                  |
| `judges.ruling.issued`            | Court convened and persisted a ruling. Payload includes `convening_reason` (`no_match`, `policy_reduce`, `policy_expand`, `all`, `judge_policy`) and `trigger_rule_ids` (populated with matching judge-rule IDs when `convening_reason` is `judge_policy`, empty otherwise) |
| `judges.court.unavailable`        | Court unavailable during deliberation                                                                                                                                                                                                                                       |
| `judges.court.unavailable.denied` | Every judge errored or timed out, so the request is denied fail-closed. Also emitted with `reason: "persistence_failed"` and `would_have: "permit"` when a `live`-mode Court `permit` fails to persist. Carries the same `convening_reason` and `trigger_rule_ids` fields   |

### State change: configuration

| Type                                | Description                                          |
| ----------------------------------- | ---------------------------------------------------- |
| `judges.constitution.created`       | Constitution created                                 |
| `judges.constitution.updated`       | Constitution updated                                 |
| `judges.constitution.deleted`       | Constitution deleted                                 |
| `judges.judge.created`              | Judge created                                        |
| `judges.judge.updated`              | Judge updated                                        |
| `judges.judge.deleted`              | Judge deleted                                        |
| `judges.panel.updated`              | Judge panel updated                                  |
| `judges.judge_panel_config.updated` | Panel seating, enabled state, or weights changed     |
| `judges.workspace_mode.updated`     | Workspace mode set to `disabled`, `audit`, or `live` |

### State change: permission denies

Read denies (lack `judges.view`):

`judges.rulings.list.denied`, `judges.ruling.read.denied`, `judges.judges.list.denied`, `judges.judge.read.denied`, `judges.judge_panel_config.read.denied`, `judges.workspace_mode.read.denied`, `judges.constitutions.list.denied`

`ListPersonalityAxes` is platform reference data and carries no permission gate, so it has no `*.denied` variant.

Write denies (lack `judges.manage`, or a preconfigured immutable target):

`judges.judge.create.denied`, `judges.judge.update.denied`, `judges.judge.delete.denied`, `judges.judge_panel_config.update.denied`, `judges.workspace_mode.update.denied`, `judges.constitution.create.denied`, `judges.constitution.update.denied`, `judges.constitution.delete.denied`

Updates and deletes of a preconfigured judge use `reason: "preconfigured_immutable"`.

## Permissions

| Permission      | Role                                                                                                                                   |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `judges.view`   | Read rulings, judges, panel config, constitution, workspace mode. Workspace `admin`, `operator`, `security`, `developer`, and `viewer` |
| `judges.manage` | Update mode and panel, and CRUD custom judges and constitution. Workspace `admin` and `operator` only                                  |

Preconfigured judges remain immutable regardless of `judges.manage`. Renamed from `moot.view` / `moot.manage` in the 2026-06 release.

## Gateway denial extension (Court)

The shipped [authorization denial protocol](/develop#authorization-denial-protocol) documents the Cedar path. When The Court determines a deny, the same `dome_authorization_denied` extension adds Court-specific fields.

| Field                | Type              | Description                                                                                          |
| -------------------- | ----------------- | ---------------------------------------------------------------------------------------------------- |
| `reason_code`        | string            | Closed vocabulary. Cedar / Court / fail-closed denials resolve to `permission_denied`.               |
| `reason`             | string            | Verbatim human reason (e.g. `forbidden by court`, `court_unavailable`). Secret-free by construction. |
| `depth`              | string            | `judges` when the Court determined the outcome (`deterministic` when Cedar alone decided).           |
| `determining_policy` | string (optional) | Empty on Court determinations (no single Cedar rule decided it).                                     |
| `court`              | object (optional) | Present only when `depth == "judges"`. Its presence is the signal that the Court convened.           |

### Court summary

When `depth == "judges"`, the `court` object carries the agent-facing summary of the Court determination. Fetch the full deliberation via `ruling_id` against the Judges read RPCs.

| Field              | Type              | Description                                                                                                                                                |
| ------------------ | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ruling_id`        | string (optional) | Persisted ruling id. Empty on degraded paths (`court_unavailable` with a persistence failure).                                                             |
| `outcome`          | string (optional) | The Court's own vote: `permit`, `forbid`, or `court_unavailable`. May differ from `final_outcome` when the directional clamp reduced a permit to a forbid. |
| `final_outcome`    | string            | The outcome actually applied after clamping: `forbid` or `court_unavailable` on a deny.                                                                    |
| `convening_reason` | string            | Why the Court was convened: `no_match`, `policy_reduce`, `policy_expand`, or `all`.                                                                        |
| `rationale`        | string (optional) | Short summary of the deciding judge's justification, surfaced verbatim. Secret-free by upstream construction.                                              |

<Note>
  On the hosted-gateway path (what most cloud customers run), `outcome` and `rationale` are not inlined. Only `final_outcome` crosses the wire. Distinguishing *court-forbade* from *court-permitted-but-clamped* on that path requires fetching the full ruling by `ruling_id`. The inline fields are populated on in-process convene.
</Note>

### Wire shapes

```json title="MCP — Court forbid" theme={"system"}
{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32001,
    "message": "forbidden by court",
    "data": {
      "type": "dome.authorization_denied",
      "reason_code": "permission_denied",
      "reason": "forbidden by court",
      "depth": "judges",
      "court": {
        "ruling_id": "rul_01HXYZ...",
        "final_outcome": "forbid",
        "convening_reason": "no_match"
      }
    }
  }
}
```

```json title="LLM (Anthropic) — Court forbid" theme={"system"}
{
  "type": "error",
  "error": {
    "type": "permission_error",
    "message": "forbidden by court"
  },
  "dome_authorization_denied": {
    "reason_code": "permission_denied",
    "reason": "forbidden by court",
    "depth": "judges",
    "court": {
      "ruling_id": "rul_01HXYZ...",
      "final_outcome": "forbid",
      "convening_reason": "no_match"
    }
  }
}
```

### Consuming the Court fields

```python theme={"system"}
def explain_deny(response_body: dict) -> str | None:
    deny = response_body.get("dome_authorization_denied")
    if not deny:
        return None

    parts = [f"Denied: {deny['reason']}"]
    if rule := deny.get("determining_policy"):
        parts.append(f"Rule: {rule}")
    if court := deny.get("court"):
        parts.append(f"Court ruling: {court.get('ruling_id', 'unavailable')}")
    return " | ".join(parts)
```

## Webhook types

Webhook catalog includes `judges.ruling.issued` (Security signals bundle and Security decisions group). High volume with other per-request security decisions. Point at a log sink rather than a chat channel.

## Next steps

With that Judges and Court model in mind, continue with:

* [Intelligent Authorization](/concepts/intelligent-authorization) concept covers the Court model, modes, and fail-closed persistence
* [Resolve Access Ambiguity](/govern/judges) explains how to configure and roll out
* [Develop](/develop#authorization-denial-protocol) documents the shipped deny extension (Cedar path)
* [Events](/reference/events) reference documents shipped Audit v1 and webhook contracts (Judges types omitted while unshipped)
* [CLI Judges](/cli/secure/judges) · [MCP Judges](/reference/mcp/judges)