Skip to main content
Govern applies the controls that decide what agents can do, what content may pass, and how much spend is allowed. You authorize with Rules, inspect traffic with Guards, and cap model spend with Quotas. Refer to Architecture concept for the request path.

​
How Govern controls a request

The following controls shape each governed request:
  • Rules make deterministic allow and deny decisions for an agent, action, and resource. They can read request arguments and verified end-user claims.
    • Use the Rules assistant when you prefer natural-language drafts, and simulate before changing production behavior.
  • Guards inspect request and response content on model and tool connections. Filters are a Guard type.
  • Quotas cap LLM spend over a window for a workspace, agent, Gateway, pool, model, or verified end user. Exhausted total caps reject the call. Exhausted model budgets can spill to another pool member.
At runtime, Dome evaluates applicable Quotas, then Rules, then Guards on the content path. Each control fails closed: exhausted limits, unavailable authorization, and blocking Guards stop the request or response. The typical workflow is:
  1. Authorize access by writing, validating, simulating, and applying Cedar Rules.
  2. Create Guards and assign Filters to the connections that need inspection.
  3. Set usage limits at the scopes that own the budget.
After setup, you can revise Rules, roll Filters forward or back, and adjust Quotas without rewiring Connect entities.

​
Next steps

  • Connect when you still need agents, delegated agents, resources, or Gateways
  • Operate to investigate audit events, stream live events, and subscribe to events
  • Manage to configure platform access, environments, integrations, and data exports
  • Develop to send runtime credentials, Gateway endpoints, and Act-As envelopes from the application