Environments

An environment in Dome is the place platform work runs: a tenant for hard isolation, a workspace for day-to-day operations, and a CLI context that points tools at that workspace.

Overview

Dome nests environments under an organization. An organization contains tenants. A tenant contains workspaces. Agents, resources, Gateways, rules, Guards, Quotas, and audit events live in a workspace. Tenants isolate data. Workspaces separate teams and environments inside a tenant. Refer to Scope Hierarchy concept for isolation and rule inheritance.

Creating a tenant or workspace defines a durable boundary. A CLI context does not create a boundary. It selects which workspace subsequent CLI and MCP commands use. A sandbox creates a throwaway tenant or workspace for a try-out instead of a durable boundary.

The typical workflow is:

1. Create a tenant when you need a new hard isolation boundary.
2. Create a workspace for the team or environment inside that tenant.
3. Select a CLI context so commands run against that workspace.
4. Optionally scaffold a project against the selected context.

Use a sandbox when you need a disposable try-out instead of steps 1–2.

The sections below explain the attributes that shape a tenant or workspace at creation, and when a sandbox is the better path.

Plans

Each tenant receives a plan that determines available features.

You set the plan when you create a tenant.

Join policies

join_policy controls how non-members enter a tenant or a workspace. Every tenant and every workspace carries its own value. The workspace policy is independent of its tenant's. New tenants and workspaces default to invite_only when the field is omitted at creation.

You set join_policy when you create a tenant or create a workspace.

Sandboxes

A sandbox is a disposable shortcut. A workspace-scoped sandbox creates a throwaway workspace in the current tenant. A tenant-scoped sandbox creates a throwaway tenant, workspace, and one-time API key. Neither path replaces a durable tenant or workspace for production work.

Use a sandbox when you need a try-out. Use create a tenant and create a workspace when the boundary must persist.

Requirements

Before you begin, authenticate the Dome CLI.

Permissions

Tenant and workspace creation use org- and tenant-scoped roles. Each operation states the permission it requires.

For exhaustive flags, tool parameters, and endpoint contracts, refer to the CLI, MCP, and API references.

Create a tenant

Create a tenant under your organization when you need a hard isolation boundary. You can set plan and join policy in the same call.

dome tenants create --name acme-prod --plan managed --join-policy request
dome tenants list

POST /v1/tenants
{
  "name": "acme-prod",
  "plan": "managed",
  "join_policy": "request"
}

Create a tenant named "acme-prod" on the managed plan.

Create a workspace

Create a durable workspace for a team or environment inside a tenant. You can set join policy in the same call. List or delete workspaces as teams and projects change.

dome workspaces create --name "payments-team" --join-policy open
dome workspaces list
dome workspaces delete <workspace-id>

POST /v1/workspaces
{
  "tenant_id": "{{TENANT_ID}}",
  "slug": "payments",
  "name": "Payments",
  "join_policy": "invite_only"
}

Create a workspace named "payments-team".

Select a CLI context

Sync after creating a tenant or workspace, then select the target so CLI and MCP commands run against that workspace.

dome context sync
dome context list
dome context use production
dome context current

Use workspace, tenant/workspace, or org/tenant/workspace shorthand when names overlap.

Provision a sandbox

Provision a sandbox for a disposable try-out instead of a durable tenant or workspace. A workspace-scoped sandbox creates a throwaway workspace in the current tenant. A tenant-scoped sandbox creates a throwaway tenant, workspace, and one-time API key.

• Workspace scope: Disposable workspace in the current tenant.
• Tenant scope: Isolated tenant, workspace, and one-time API key.

dome sandbox provision --scope=workspace --workspace-name my-sandbox
dome sandbox provision --scope=tenant --tenant-name my-sandbox

{
  "scope": "workspace",
  "workspace_name": "my-sandbox"
}

POST /v1/workspaces/sandbox
{ "name": "my-sandbox" }

POST /v1/tenants/sandbox
{
  "org_id": "{{ORG_ID}}",
  "tenant_name": "my-sandbox",
  "workspace_name": "my-sandbox"
}

Provision a workspace sandbox named "my-sandbox".

Tenant-scoped responses include the tenant, workspace, API key ID, and one-time API key secret. Sync context after the sandbox is ready.

Scaffold a project

Create a starter project against the selected environment.

dome quickstart my-agent-project

The command generates SDK setup, dome.yaml, environment placeholders, a Dockerfile, and starter Cedar rules.

Next steps

• Manage Access
• Configure Platform
• Quickstart