Interactive MCP access

Interactive access lets people sign in with their own Dome account instead of holding an agent key. Each person authorizes once in a browser, then every call is audited under their own identity, not a shared credential.

Overview

Interactive access is a setting on one Gateway. Enabling it creates one managed agent, named gateway-interactive-<gateway-id>, that every allow-listed person shares as the identity their MCP client rides.

The managed agent behaves like a regular agent everywhere else. Cedar Rules still authorize its calls and Quotas still cap its spend. Enabling interactive access grants it access to its own Gateway automatically, so the only step left is a Rule permitting what it may call.

Each signed-in call also carries the person's verified identity into Cedar as principal.act_as, the same attribute Rules read for delegated agents. A Rule can scope by principal.act_as.email when different people need different access, not just one blanket permit for the managed agent.

Requirements

Before you begin:

• Authenticate to Dome and select a workspace
• Create or select a Gateway with the resources people should reach
• Collect the email addresses or IdP subjects to allow-list
• Every person you allow-list needs their own effective agents.view access to the workspace; an email on the list is not enough by itself

Eligibility and consent

A person can ride the managed agent only when every check passes:

1. Interactive access is enabled.
2. The verified email or subject matches the allow-list.
3. The person has effective agents.view access to the workspace.
4. The agent is not device-bound, suspended, or revoked.
5. The agent is admitted to the addressed Gateway.
6. The organization is writable.

The consent page only shows eligible agents. Dome rechecks eligibility at consent, code redemption, and every token refresh.

Approval is never remembered. The last agent may be preselected, but the person confirms each new authorization.

Token and grant behavior

Interactive access tokens expire within 10 minutes and target one canonical Gateway resource. They cannot call control-plane APIs or another Gateway.

The public MCP client uses authorization code flow with S256 PKCE. Refresh tokens rotate after one use. A replay revokes the entire grant family.

Dome rechecks identity continuity, email, access, agent state, Gateway admission, and organization state before renewal. Lost eligibility stops renewal; transient provider failures leave the current refresh token retryable.

Enable interactive access

Enable interactive access when people should connect their own MCP clients without receiving an agent API key.

dome gateways interactive enable prod-resources \
  --email alice@example.com \
  --subject {{IDP_SUBJECT}}

--email and --subject are repeatable. Enabling replaces both allow-lists, and matching is exact and case-sensitive. At least one email or subject is required; groups cannot match an interactive login.

Confirm the managed agent's name, which the next section needs to authorize it:

dome gateways get prod-resources --json

Read interactive_access.managed_agent_name (or .managed_agent_id) from the response.

Authorize the managed agent

Gateway admission gets the managed agent to the edge. It does not permit it to call anything. Deploy a Rule scoped to its name, the same way you would for any agent:

permit(
  principal is Dome::Agent,
  action == Dome::Action::"mcp:discover",
  resource
);

permit(
  principal is Dome::Agent,
  action == Dome::Action::"mcp:call",
  resource
);

dome rules apply interactive-access.cedar \
  --agent gateway-interactive-{{GATEWAY_ID}} \
  --name interactive-access

Scope the allowlist to individual tools or pools the same way you would for a registered agent. Refer to Authorize Access for allow, deny, and per-person Rules keyed on principal.act_as.email.

Connect an MCP client

Copy the authoritative mcp_url from dome gateways get prod-resources --json or the Gateway page. Add that remote URL to your client with no token or header. The first connection receives an OAuth challenge and opens a browser: sign in with your Dome account, select an eligible agent, review the client and exposed tools, then approve.

Configure the client for Streamable HTTP, not SSE. The Gateway does not support the legacy standalone SSE transport.

{
  "mcpServers": {
    "dome-gateway": {
      "url": "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp"
    }
  }
}

claude mcp add --transport http dome-gateway \
  https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp

[mcp_servers.dome-gateway]
url = "https://{{GATEWAY_HOST}}/gateways/{{GATEWAY_ID}}/mcp"

codex mcp login dome-gateway

This browser login is not a Dome Dashboard session. The OAuth callback binds the identity to this authorization transaction and returns the client to its registered redirect URI.

List and revoke grants

List and revoke grants from Settings → Interactive access or the CLI:

dome agents interactive-grants list
dome agents interactive-grants list --all-users
dome agents interactive-grants revoke {{GRANT_ID}}

People can list and revoke their own grants. Workspace-wide listing requires agents.view; revoking another person's grant requires agentkeys.manage.

Disable interactive access

dome gateways interactive disable prod-resources

Disabling preserves the managed agent and allow-lists. Existing access tokens expire within minutes and stop renewing. Re-enable with explicit email or subject flags to replace the saved allow-lists.

Next steps

• Gateways for membership, agent-key access, and runtime endpoints
• Delegated agents for principal.act_as and claim-aware Rules
• Authorize Access to scope what the managed agent, or one signed-in person, may call