> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access

> Assign workspace roles and manage scoped platform API keys

export const access = "Access controls who can administer a workspace and which operations automation can perform through the Dome API. Platform memberships and platform API keys grant administration permissions separate from agent runtime authorization.";

<p>
  {access}
</p>

## Overview

Dome separates platform administration from runtime agent access. A workspace role or platform API key governs CLI commands, API endpoints, and MCP management tools. [Rules](/govern/rules) govern what a registered agent may do at the gateway. Refer to [Permissions](/concepts/platform/permissions) concept for the two-layer model.

Memberships attach people to a workspace with one role. Platform API keys attach automation to a `workspace`, `tenant`, or `org` scope with an explicit permission list. Agent API keys authenticate agent runtimes and use a separate lifecycle. Refer to [create an agent API key](/connect/agents#create-key) for agent credentials.

The typical workflow is:

1. [Assign a workspace member](#manage-workspace-members) a role that matches their job.
2. [Create a platform API key](#manage-platform-api-keys) for CI/CD or user automation that must call the Dome API.
3. Revoke keys and remove memberships when access is no longer needed.

Apply least privilege to memberships and platform API keys.

The sections below explain the roles you can assign and how platform API keys are scoped.

### Workspace roles

Assign one role per member in each workspace. Roles apply per workspace. The same user can hold different roles across workspaces.

| Role       | Access                         |
| ---------- | ------------------------------ |
| `admin`    | Full workspace management.     |
| `operator` | Agent and gateway operations.  |
| `security` | Authorization rules and audit. |
| `viewer`   | Read-only access.              |

You set the role when you [assign a workspace member](#manage-workspace-members).

### Platform API keys

Platform API keys authenticate automation against the Dome API. Scope a key to `workspace`, `tenant`, or `org`. Set expiration for temporary automation and revoke unused keys immediately.

Agent credentials use a separate lifecycle. For agent authentication, [create an agent API key](/connect/agents#create-key).

You create, list, and revoke keys when you [manage platform API keys](#manage-platform-api-keys).

## Requirements

Before you begin, authenticate the Dome CLI and select a workspace context.

### Permissions

Member and platform API key management require elevated roles. Each operation states the permission it requires.

For exhaustive flags, tool parameters, and endpoint contracts, refer to the [CLI](/cli/settings/workspace#members), [MCP](/reference/mcp/workspaces#members), and [API](/api/management/set-workspace-membership) references.

| Default roles                             | Permission                 | Grants                                        |
| ----------------------------------------- | -------------------------- | --------------------------------------------- |
| Workspace `admin` (or equivalent cascade) | Workspace admin membership | Assign and remove workspace members and roles |
| `admin`, `operator` (at the target scope) | `apikey.manage`            | Create, list, and revoke platform API keys    |

## Manage workspace members

Assign one role per member in each workspace. Choose from the [workspace roles](#workspace-roles) above.

<Callout icon="key">Requires workspace `admin` (or an equivalent cascaded role).</Callout>

<Tabs>
  <Tab title="CLI">
    ```bash theme={"system"}
    dome workspace members list
    dome workspace members set --user user@example.com --role operator
    dome workspace members remove --user user@example.com --revoke-all-keys
    ```

    | Flag                | Applies to  | Description                                   |
    | ------------------- | ----------- | --------------------------------------------- |
    | `--user`            | set, remove | User email address.                           |
    | `--role`            | set         | `admin`, `operator`, `security`, or `viewer`. |
    | `--revoke-keys`     | remove      | API key IDs to revoke during removal.         |
    | `--revoke-all-keys` | remove      | Revokes every API key created by the user.    |

    <Callout icon="terminal">Reference: [`dome workspace members`](/cli/settings/workspace#members)</Callout>
  </Tab>

  <Tab title="MCP">
    Tools: `dome_workspace_members_list`, `dome_workspace_members_set`, `dome_workspace_members_remove`

    <Callout icon="cpu">Reference: [`dome_workspace_members_set`](/reference/mcp/workspaces#workspace-members-set)</Callout>
  </Tab>

  <Tab title="API">
    RPCs: `ListWorkspaceMemberships`, `SetWorkspaceMembership`, `RemoveWorkspaceMembership`

    ```http theme={"system"}
    POST /dome.mgmt.v1.Management/SetWorkspaceMembership
    Content-Type: application/json

    {
      "tenant_id": "{{TENANT_ID}}",
      "workspace_id": "{{WORKSPACE_ID}}",
      "user_email": "user@example.com",
      "role": "operator"
    }
    ```

    <Callout icon="code">Reference: [`SetWorkspaceMembership`](/api/management/set-workspace-membership)</Callout>
  </Tab>

  <Tab title="Agent">
    ```text title="Assign a workspace role" theme={"system"}
    Set member "user@example.com" to the operator role.
    ```
  </Tab>
</Tabs>

## Manage platform API keys

Create scoped keys for CI/CD pipelines and user automation. Agent credentials use a separate lifecycle.

<Callout icon="key">Requires `apikey.manage` at the scope where you create the key.</Callout>

<Tabs>
  <Tab title="CLI">
    ```bash theme={"system"}
    dome platform-keys list
    dome platform-keys create \
      --name "ci-deploy" \
      --permissions rules.deploy,agent.register \
      --expires-at 2026-12-31T00:00:00Z
    dome platform-keys revoke ci-deploy
    ```

    <Callout icon="terminal">Reference: [`dome platform-keys`](/cli/settings/platform-keys)</Callout>
  </Tab>

  <Tab title="MCP">
    Tools: `dome_platform_keys_list`, `dome_platform_keys_create`, `dome_platform_keys_revoke`

    <Callout icon="cpu">Reference: [`dome_platform_keys_create`](/reference/mcp/platform#platform-keys-create)</Callout>
  </Tab>

  <Tab title="API">
    RPCs: `ListAPIKeys`, `CreateAPIKey`, `RevokeAPIKey`

    ```http theme={"system"}
    POST /dome.mgmt.v1.Management/CreateAPIKey
    Content-Type: application/json

    {
      "name": "ci-deploy",
      "permissions": ["rules.deploy", "agent.register"],
      "expires_at": "2026-12-31T00:00:00Z",
      "scope_kind": "workspace",
      "scope_id": "{{WORKSPACE_ID}}"
    }
    ```

    <Callout icon="code">Reference: [`CreateAPIKey`](/api/management/create-api-key)</Callout>
  </Tab>

  <Tab title="Agent">
    ```text title="Create a platform API key" theme={"system"}
    Create a platform API key named "ci-deploy" with permissions rules.deploy and agent.register.
    ```
  </Tab>
</Tabs>

Scope keys to `workspace`, `tenant`, or `org`. Set expiration for temporary automation and revoke unused keys immediately.

For agent authentication, [create an agent API key](/connect/agents#create-key).

## Next steps

* [Configure Platform](/manage/settings)
* [Permissions](/concepts/platform/permissions) concept
* [Create an agent API key](/connect/agents#create-key)