> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect

> Agents, resources, and Gateways that give workloads governed access to tools and models

export const quota = "A Quota caps governed LLM spend in USD over a daily or monthly window for a workspace, agent, Gateway, pool, or model. Dome rejects or reroutes metered calls when the budget is exhausted.";

export const guard = "Guards inspect request and response content on tool and model connections. They can redact, omit, or block sensitive text before it reaches an agent or upstream backend.";

export const rule = "Rules are Cedar permit and forbid policies Dome evaluates on every governed tool or model request. They decide which calls an admitted agent may make after Gateway access.";

**Connect** defines the entities an agent needs to reach tools and models: agent identity, resources, and Gateways. Dome stores upstream credentials on those resources. Agents authenticate to Dome, not to every backend.

Refer to [Core Concepts](/concepts) for how the pieces fit together and [Architecture](/concepts/architecture) concept for the request path.

## How Connect defines entities

The following entities are what you configure in Dome so workloads can call tools and models:

* **Agents** identify the applications and automated processes making requests. Credentials authenticate inbound traffic.
  * **Delegated agents** act for a verified person. Dome verifies act-as before authorization so Rules, Quotas, and egress can use trusted claims. Choose standing vs delegated on the [Identity Patterns](/concepts/identity-patterns) concept.
* **Resources** are what agents call through Dome:
  * **Tools** are MCP servers and related backends.
  * **Models** are LLM provider connections.
  * **Pools** group model connections behind one name with routing and failover.
* **Gateways** package resource membership and agent grants behind one runtime URL.

An agent authenticates to Dome and reaches members only through a Gateway that admits it. It never holds the upstream credentials stored on those resources. <Tooltip tip={rule} cta="See glossary" href="/reference/glossary#rule">Rules</Tooltip>, <Tooltip tip={guard} cta="See glossary" href="/reference/glossary#guard">Guards</Tooltip>, and <Tooltip tip={quota} cta="See glossary" href="/reference/glossary#quota">Quotas</Tooltip> still decide what the call may do, what content may pass, and how much spend is allowed after admission.

The typical workflow is:

1. [Register an agent](/connect/agents), allow the resources it needs, and issue credentials.
2. When access must depend on the person the agent acts for, configure [delegated agents](/connect/agents/delegated).
3. Add [tools](/connect/resources/tools), [models](/connect/resources/models), and [pools](/connect/resources/models/pools) when you want a stable name, routing, or failover.
4. Create a [Gateway](/connect/gateways), attach those resources as members, and grant the agent access.
5. Point the [runtime](/develop) at the agent credential, Gateway endpoint, and any Act-As envelope.

After setup, you can rotate credentials, update connections and memberships, or manage lifecycle without rebuilding the rest of the configuration.

## Next steps

* [Govern](/govern) to authorize actions, set usage limits, and inspect content
* [Operate](/operate) to investigate audit events, stream live events, and subscribe to events
* [Manage](/manage) for platform access, environments, integrations, and data exports
* [Develop](/develop) to send runtime credentials, Gateway endpoints, and Act-As envelopes from the application