> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Govern

> Authorize actions, filter content, and set usage limits for governed agent traffic

**Govern** applies the controls that decide what agents can do, what content may pass, and how much spend is allowed. You authorize with Rules, inspect traffic with Guards, and cap model spend with Quotas.

Refer to [Architecture](/concepts/architecture) concept for the request path.

## How Govern controls a request

The following controls shape each governed request:

* **Rules** make deterministic allow and deny decisions for an agent, action, and resource. They can read request arguments and verified end-user claims.
  * Use the [Rules assistant](/govern/rules/assistant) when you prefer natural-language drafts, and [simulate](/govern/rules/simulate) before changing production behavior.
* **Guards** inspect request and response content on model and tool connections. Filters are a Guard type.
* **Quotas** cap LLM spend over a window for a workspace, agent, Gateway, pool, model, or verified end user. Exhausted total caps reject the call. Exhausted model budgets can spill to another pool member.

At runtime, Dome evaluates applicable Quotas, then Rules, then Guards on the content path. Each control fails closed: exhausted limits, unavailable authorization, and blocking Guards stop the request or response.

The typical workflow is:

1. [Authorize access](/govern/rules) by writing, validating, simulating, and applying Cedar Rules.
2. Create [Guards](/govern/guards) and assign Filters to the connections that need inspection.
3. [Set usage limits](/govern/quotas) at the scopes that own the budget.

After setup, you can revise Rules, roll Filters forward or back, and adjust Quotas without rewiring Connect entities.

## Next steps

* [Connect](/connect) when you still need agents, delegated agents, resources, or Gateways
* [Operate](/operate) to investigate audit events, stream live events, and subscribe to events
* [Manage](/manage) to configure platform access, environments, integrations, and data exports
* [Develop](/develop) to send runtime credentials, Gateway endpoints, and Act-As envelopes from the application