Access

Access controls who can administer a workspace and which operations automation can perform through the Dome API. Platform memberships and platform API keys grant administration permissions separate from agent runtime authorization.

Overview

Dome separates platform administration from runtime agent access. A workspace role or platform API key governs CLI commands, API endpoints, and MCP management tools. Rules govern what a registered agent may do at the gateway. Refer to Permissions concept for the two-layer model.

Memberships attach people to a scope with one role. Platform API keys attach automation to a workspace, tenant, or org scope with an explicit permission list. Agent API keys authenticate agent runtimes and use a separate lifecycle. Refer to create an agent API key for agent credentials.

The typical workflow is:

1. Assign a workspace member a role that matches their job.
2. Manage organization members when someone needs org-wide standing grants.
3. Create a custom role when the built-in roles do not fit.
4. Create a platform API key for CI/CD or user automation that must call the Dome API.
5. Revoke keys and remove memberships when access is no longer needed.

Apply least privilege to memberships and platform API keys.

The sections below explain the roles you can assign and how platform API keys are scoped.

Workspace roles

Assign one role per member in each workspace. Roles apply per workspace. The same user can hold different roles across workspaces.

You set the role when you assign a workspace member.

Custom roles

Custom roles are named, user-defined permission sets. Create them at workspace, tenant, or organization scope, then assign them by name through the normal membership flow. Their permissions apply at that scope and cascade to scopes below it, just like built-in roles.

Creating a custom role is an Enterprise capability. Existing custom roles continue to work and can be updated or removed after a plan change. You can only include permissions you already hold, so a custom role cannot grant more authority than its creator has.

# Create a workspace role, then assign it to a workspace member.
dome roles create audit-reader \
  --scope workspace \
  --permissions audit.view,rules.view \
  --description "Read audit evidence and deployed Rules"
dome workspaces members set --user analyst@example.com --role audit-reader

Use dome roles list, dome roles get <name>, and dome roles update <name> to inspect and maintain definitions. Before deleting an assigned role, choose whether to reassign or remove its holders. Dome refuses a delete if membership changed while you were reviewing its holders.

Platform API keys

Platform API keys authenticate automation against the Dome API. Scope a key to workspace, tenant, or org. Set expiration for temporary automation and revoke unused keys immediately.

Agent credentials use a separate lifecycle. For agent authentication, create an agent API key.

You create, list, and revoke keys when you manage platform API keys.

Requirements

Before you begin, authenticate the Dome CLI and select a workspace context.

Permissions

Member and platform API key management require elevated roles. Each operation states the permission it requires.

For exhaustive flags, tool parameters, and endpoint contracts, refer to the CLI, MCP, and API references.

Manage workspace members

Assign one role per member in each workspace. Choose from the workspace roles above.

dome workspaces members list
dome workspaces members set --user user@example.com --role operator
dome workspaces members remove --user user@example.com --revoke-all-keys

PUT /v1/workspaces/{{WORKSPACE_ID}}/members
Content-Type: application/json

{
  "tenant_id": "{{TENANT_ID}}",
  "user_email": "user@example.com",
  "role": "operator"
}

Set member "user@example.com" to the operator role.

Manage organization members

Grant or change org-level roles (owner, admin, member) for an existing platform user, or remove an org membership. Org membership is separate from workspace membership — a user can hold an org role without a workspace seat, and a workspace invitee can lack org standing grants.

Rules:

• The target user must already exist on the platform — grants do not create users
• Removing the last owner returns FailedPrecondition
• Successful assigns emit organization.membership.set; removals emit organization.membership.unset

POST /dome.mgmt.v1.Management/ListOrgMembers
Content-Type: application/json

{ "org_id": "{{ORG_ID}}" }

POST /dome.mgmt.v1.Management/AssignOrgRole
Content-Type: application/json

{
  "org_id": "{{ORG_ID}}",
  "user_email": "admin@example.com",
  "role": "admin"
}

POST /dome.mgmt.v1.Management/RemoveOrgMember
Content-Type: application/json

{
  "org_id": "{{ORG_ID}}",
  "user_email": "admin@example.com"
}

List organization members for the active org, then assign admin@example.com the admin role.

Org owner and admin also hold org-scoped audit.view for org-wide audit queries. Role matrices are on the Permissions reference.

Manage platform API keys

Create scoped keys for CI/CD pipelines and user automation. Agent credentials use a separate lifecycle.

dome platform-keys list
dome platform-keys create \
  --name "ci-deploy" \
  --permissions rules.deploy,agent.register \
  --expires-at 2026-12-31T00:00:00Z
dome platform-keys revoke ci-deploy

POST /v1/platform-keys
Content-Type: application/json

{
  "name": "ci-deploy",
  "permissions": ["rules.deploy", "agent.register"],
  "expires_at": "2026-12-31T00:00:00Z",
  "scope_kind": "workspace",
  "scope_id": "{{WORKSPACE_ID}}"
}

Create a platform API key named "ci-deploy" with permissions rules.deploy and agent.register.

Scope keys to workspace, tenant, or org. Set expiration for temporary automation and revoke unused keys immediately.

For agent authentication, create an agent API key.

Next steps

• Configure Platform
• Permissions concept
• Create an agent API key