Skip to main content
Judges resolve ambiguous access requests through auditable, multi-model deliberation. A panel of LLM judges weighs evidence and workspace constitution and returns a ruling.
Judges is in preview. Start in audit mode, inspect rulings, and tune the panel and constitution before allowing rulings to affect live requests.

​
Overview

Judges sits after deterministic Rules. Cedar produces a baseline permit, forbid, or no_match. When the workspace convening trigger says so, the Court reviews the request. Rulings are recorded on the audit trail. Refer to Judges concept for judges.* event types. The typical workflow is:
  1. Keep deterministic requirements in Rules.
  2. Configure the panel and constitution below.
  3. Roll out Judges in audit mode, review outcomes, then move to live when ready.
The sections below explain decision flow, convening triggers, modes, the panel, the constitution, evidence and authority, rulings, fail-closed behavior, and permissions.

​
Decision flow

  1. Cedar Rules produce a deterministic baseline: permit, forbid, or no_match.
  2. The workspace convening trigger decides whether the Court reviews the request.
  3. Each enabled judge evaluates the same case context and casts a weighted vote.
  4. Dome tallies the votes, applies the Court’s configured directional authority, and records the ruling.
  5. The workspace mode determines whether the agent receives the deterministic baseline or the Court-adjusted outcome.
A Court failure never grants access. If fewer than two judges return usable votes, the request resolves to court_unavailable and is denied.

​
Choose when the Court convenes

Use no_match to cover gaps in deterministic Rules. Use Judge Rules when the request pattern itself should control contextual review. Use policy escalation when a bundle owner should explicitly authorize review of selected deterministic outcomes.

​
Choose how rulings affect requests

New workspaces start with Judges disabled. audit is the recommended rollout path.

​
The panel

The panel is the workspace’s set of enabled judges and their weights. Dome includes preconfigured judges for common perspectives. Their definitions are immutable, but you can enable, disable, and reweight them. You can also create custom judges with:
  • A system prompt
  • Personality-axis settings
  • A high, medium, or low vote weight
Do not place enforceable requirements only in a judge prompt. Use Rules for deterministic requirements and Guards for content that must be blocked or transformed.

​
The constitution

The constitution is a workspace-wide set of clauses included in every deliberation. Use it for contextual guidance such as required evidence, business justification, escalation norms, or regulatory framing.
Example constitution clause
Constitution clauses guide deliberation. They are not deterministic Rules. Judges can weigh a clause against other evidence.

​
Evidence and authority

Every case includes a deliberation context derived from the live deterministic decision: The Court scope on a Rule bundle constrains how far a ruling can move a deterministic baseline: The final outcome applies this clamp even when the raw vote points outside the Court’s authority.

​
Rulings and audit

Every convening creates a ruling with:
  • The deterministic baseline and final outcome
  • Per-judge votes, weights, reasoning, and errors
  • Applied constitution clauses
  • Confidence, latency, and partial-result state
  • Snapshots needed to reproduce the deliberation context
Authorization decisions reviewed by Judges carry depth: "judges" and a ruling_id. In audit mode, the decision remains deterministic but still includes the ruling reference so operators can compare the would-have outcome.
Decision with a ruling

​
Fail-closed behavior

The Court requires at least two usable votes. Timeouts, provider errors, malformed output, or loss of quorum produce court_unavailable. Dome denies the request and records the failure. If a live permit cannot be persisted, Dome also denies because an outcome without a forensic record cannot be enforced safely.

​
Requirements

Before you begin, authenticate to Dome and select a workspace.

​
Permissions

Judges configuration and rulings use platform permissions. Preconfigured judges remain immutable regardless of judges.manage.

​
Roll out Judges

1

Keep deterministic requirements in Rules

Confirm that mandatory restrictions and common allow paths are covered by Cedar.
2

Configure the panel and constitution

Choose perspectives, weights, and contextual guidance for ambiguous cases.
3

Enable audit mode

Select a narrow convening trigger and collect would-have rulings without changing agent outcomes.
4

Review outcomes

Compare rulings with deterministic decisions, inspect partial cases, and adjust configuration.
5

Enable live mode

Move to live enforcement only after the observed rulings meet your acceptance criteria.