Quotas

A Quota caps governed LLM spend in USD over a daily or monthly window for a workspace, agent, Gateway, pool, or model. Dome rejects or reroutes metered calls when the budget is exhausted.

Overview

The gateway meters token usage on completed calls, prices it at per-model rates, updates spend for the window, and enforces every applicable Quota. Limit changes reach the gateway on the next config sync. Refer to Quotas concept for how that differs from spend accrual.

Workspace Quotas each have a subject, a limit, a reset window, an optional name, and an enabled flag. Subject identity is fixed at create time. Create is insert-only for each subject identity and window pair. Disabled Quotas remain listed but are not enforced. Organization and tenant contexts instead use shared usage allowances; see Set an organization or tenant usage allowance.

The typical workflow is:

1. Set a Quota for the subject that owns the budget.
2. Optionally set a Gateway Quota when spend should follow a gateway.
3. Update, list, or remove Quotas as budgets change.

Requirements

Before you begin:

• Authenticate to Dome and select a workspace
• Have the subject already configured (agent, model, pool, Gateway, or a subject verified via Delegated agents as needed)
• Use a plan that allows cost Quotas for the workspace. Cost Quotas are included on the Pro plan. Free workspaces ship with a create limit of zero.

Permissions

Quota operations require platform permissions. Each operation restates its permission inline.

Set a Quota

Create a cap for a workspace, agent, act-as subject, pool, model, Gateway (gateway), tool, or tool connection. Subject identity cannot change after create. Pass --disabled / disabled to create a Quota that is stored but not enforced until you enable it. Windows are daily (UTC midnight) or monthly (UTC month start, default monthly). Exhaustion behavior and event names are on the Quotas reference.

In the dashboard, open Models → Cost quotas, choose the subject and target, set the USD limit and window, then save. Model Quotas can cover a model globally or only within a selected pool, with an optional per-caller toggle.

dome quotas set \
  --subject workspace \
  --limit 5000 \
  --window monthly \
  --name workspace-monthly

dome quotas set \
  --subject agent \
  --agent <agent-id> \
  --limit 25 \
  --window daily

dome quotas set \
  --subject pool \
  --pool production \
  --limit 2500 \
  --window monthly

dome quotas set \
  --subject model \
  --model claude-sonnet \
  --pool production \
  --limit 1000 \
  --window monthly

{
  "subject": "model",
  "model": "claude-sonnet",
  "pool": "production",
  "limit_usd": 1000,
  "window": "monthly"
}

POST /v1/quotas
Content-Type: application/json

{
  "workspace_id": "<workspace-uuid>",
  "subject_type": "model",
  "subject_id": "<model-connection-uuid>",
  "pool_id": "<pool-uuid>",
  "limit_micros": 1000000000,
  "window": "monthly",
  "name": "sonnet-in-production"
}

Create a monthly \$1000 Quota on model "claude-sonnet" within pool "production".

Set an organization or tenant usage allowance

Select an organization or tenant context, then use the same dome quotas commands without --subject. The allowance covers the selected scope as a whole, rather than an individual resource. It can cap all governed traffic, only LLM traffic, or only tool traffic.

dome context use <tenant-context>
dome quotas set --dimension tool --unit calls --limit 10000 --window daily

dome context use <organization-context>
dome quotas set --dimension all --unit dome_usd --limit 5000 --window monthly

For organization and tenant allowances, all defaults to dome_usd, llm defaults to tokens, and tool defaults to calls. Use dome quotas list, dome quotas update <id>, and dome quotas rm <id> in the same context to manage the allowance. Gateway and resource subject flags do not apply at these levels.

Set an Act-As Quota

Create a Quota for one verified end-user subject. The Quota applies only when Delegated agents verification has confirmed that subject on the call.

dome quotas set \
  --subject act-as \
  --act-as user-123 \
  --limit 10 \
  --window daily

Set a per-caller model Quota

Create a model Quota that tracks each agent and each verified end user independently instead of combining their spend.

dome quotas set \
  --subject model \
  --model gpt-4o \
  --per-caller \
  --limit 5 \
  --window daily

Set a Gateway Quota

Create a Quota that covers all LLM calls routed through a Gateway's model pools and direct model connections. Use --subject gateway on the same dome quotas set command as every other subject.

dome quotas set \
  --subject gateway \
  --gateway prod-tools \
  --limit 500 \
  --window monthly \
  --name prod-monthly

{
  "subject": "gateway",
  "gateway": "prod-tools",
  "limit_usd": 500,
  "window": "monthly",
  "name": "prod-monthly"
}

POST /v1/quotas
Content-Type: application/json

{
  "workspace_id": "<workspace-uuid>",
  "subject_type": "gateway",
  "subject_id": "<gateway-uuid>",
  "limit_micros": 500000000,
  "window": "monthly",
  "name": "prod-monthly"
}

Create a monthly \$500 Quota on Gateway "prod-tools" named "prod-monthly".

Update a Quota

Update a Quota's name, USD limit, window, or enabled state. Subject identity cannot change. Create a new Quota to cover a different subject.

Only the fields you pass change. Disable a Quota to pause enforcement without deleting its definition or history.

dome quotas update <quota-id> \
  --limit 7500 \
  --enabled=true

{
  "quota_id": "<quota-id>",
  "limit_usd": 7500,
  "enabled": true
}

PATCH /v1/quotas/<quota-uuid>
Content-Type: application/json

{
  "workspace_id": "<workspace-uuid>",
  "limit_micros": 7500000000,
  "enabled": true
}

List Quotas

List Quotas in the workspace, including disabled ones. Listing returns each Quota's id, subject, USD limit, window, and enabled state.

dome quotas list
dome quotas list --gateway prod-tools

{
  "name": "dome_quotas_list",
  "arguments": {}
}

{
  "gateway": "prod-tools"
}

GET /v1/quotas?workspace_id=<workspace-uuid>

Remove a Quota

Remove a Quota by id. Listing first is the usual way to obtain the id.

dome quotas rm <quota-id>

{
  "quota_id": "<quota-id>"
}

DELETE /v1/quotas/<quota-uuid>?workspace_id=<workspace-uuid>

Next steps

• Quotas concept for how spend caps work
• Quotas reference for subjects, windows, and event names
• Pools for routing strategies and failover
• Delegated agents so Act-As Quotas match live verified subjects
• Models for the models and pools a Quota can target