Environments

Overview

Dome nests environments under an organization. An organization contains tenants. A tenant contains workspaces. Agents, resources, Gateways, rules, Guards, Quotas, and audit events live in a workspace. Tenants isolate data. Workspaces separate teams and environments inside a tenant. Refer to Scope Hierarchy concept for isolation and rule inheritance. Creating a tenant or workspace defines a durable boundary. A CLI context does not create a boundary. It selects which workspace subsequent CLI and MCP commands use. A sandbox creates a throwaway tenant or workspace for a try-out instead of a durable boundary. The typical workflow is:

Create a tenant when you need a new hard isolation boundary.
Create a workspace for the team or environment inside that tenant.
Select a CLI context so commands run against that workspace.
Optionally scaffold a project against the selected context.

Use a sandbox when you need a disposable try-out instead of steps 1–2. The sections below explain the attributes that shape a tenant or workspace at creation, and when a sandbox is the better path.

Plans

Each tenant receives a plan that determines available features.

Plan	Use for
`sandbox`	Experimentation and testing
`essential`	Core platform features
`managed`	Dome-managed platform + gateway
`enterprise`	Full feature set with SLA
`complete`	Everything, including custom integrations

You set the plan when you create a tenant.

Join policies

join_policy controls how non-members enter a tenant or a workspace. Every tenant and every workspace carries its own value. The workspace policy is independent of its tenant’s. New tenants and workspaces default to invite_only when the field is omitted at creation.

`join_policy`	Who can enter
`open`	Verified-domain users join automatically
`request`	Users request access. Admins approve
`invite_only`	Admins must invite users (default)

You set join_policy when you create a tenant or create a workspace.

Sandboxes

A sandbox is a disposable shortcut. A workspace-scoped sandbox creates a throwaway workspace in the current tenant. A tenant-scoped sandbox creates a throwaway tenant, workspace, and one-time API key. Neither path replaces a durable tenant or workspace for production work. Use a sandbox when you need a try-out. Use create a tenant and create a workspace when the boundary must persist.

Requirements

Before you begin, authenticate the Dome CLI.

Permissions

Tenant and workspace creation use org- and tenant-scoped roles. Each operation states the permission it requires. For exhaustive flags, tool parameters, and endpoint contracts, refer to the CLI, MCP, and API references.

Default roles	Permission	Grants
Org `admin` or `owner`	`tenant.manage`	Create tenants or provision tenant sandboxes
Tenant `admin`, `operator`, or `security`	Workspace / sandbox create	Create workspaces or provision workspace sandboxes

Create a tenant

Create a tenant under your organization when you need a hard isolation boundary. You can set plan and join policy in the same call.

Requires org-level tenant.manage (held by org admin or owner).

CLI
MCP
API
Agent

dome tenants create --name acme-prod --plan managed
dome tenants list

Flag	Description
`--name`	Tenant display name (required).
`--plan`	`essential` (default), `managed`, `enterprise`, or `complete`.
`--org-id`	Target org. Defaults to the active context’s org.

Reference: dome tenants create

Tools: dome_tenants_create, dome_tenants_list, dome_tenants_get

Reference: dome_tenants_create

POST /dome.mgmt.v1.Management/CreateTenant
{
  "name": "acme-prod",
  "plan": "managed",
  "join_policy": "request"
}

Reference: CreateTenant

Create a tenant

Create a tenant named "acme-prod" on the managed plan.

Create a workspace

Create a durable workspace for a team or environment inside a tenant. You can set join policy in the same call. List or delete workspaces as teams and projects change.

Requires a tenant admin, operator, or security role.

CLI
MCP
API
Agent

dome workspace create --name "payments-team"
dome workspace list
dome workspace delete <workspace-id>

Reference: dome workspace

Tools: dome_workspaces_create, dome_workspaces_list, dome_workspaces_get, dome_workspaces_delete

Reference: dome_workspaces_create

POST /dome.mgmt.v1.Management/CreateWorkspace
{
  "tenant_id": "{{TENANT_ID}}",
  "slug": "payments",
  "name": "Payments",
  "join_policy": "invite_only"
}

Reference: CreateWorkspace

Create a workspace

Create a workspace named "payments-team".

Select a CLI context

Sync after creating a tenant or workspace, then select the target so CLI and MCP commands run against that workspace.

dome context sync
dome context list
dome context use production
dome context current

Use workspace, tenant/workspace, or org/tenant/workspace shorthand when names overlap.

Provision a sandbox

Provision a sandbox for a disposable try-out instead of a durable tenant or workspace. A workspace-scoped sandbox creates a throwaway workspace in the current tenant. A tenant-scoped sandbox creates a throwaway tenant, workspace, and one-time API key.

Workspace scope: Disposable workspace in the current tenant.
Tenant scope: Isolated tenant, workspace, and one-time API key.

Workspace sandboxes require a tenant admin, operator, or security role. Tenant sandboxes require org admin or owner.

CLI
MCP
API
Agent

dome sandbox provision --scope=workspace --workspace-name my-sandbox
dome sandbox provision --scope=tenant --tenant-name my-sandbox

Flag	Default	Description
`--scope`	Required	`tenant` or `workspace`.
`--tenant-name`	Generated	Tenant suffix for tenant scope.
`--workspace-name`	Generated	Workspace suffix.

Reference: dome sandbox

Tool: dome_provision_sandbox

{
  "scope": "workspace",
  "workspace_name": "my-sandbox"
}

Reference: dome_provision_sandbox

Workspace scope:

POST /dome.mgmt.v1.Management/ProvisionSandboxWorkspace
{ "name": "my-sandbox" }

Tenant scope:

POST /dome.mgmt.v1.Management/ProvisionSandboxTenant
{
  "org_id": "{{ORG_ID}}",
  "tenant_name": "my-sandbox",
  "workspace_name": "my-sandbox"
}

Reference: ProvisionSandboxWorkspace

Provision a sandbox

Provision a workspace sandbox named "my-sandbox".

Tenant-scoped responses include the tenant, workspace, API key ID, and one-time API key secret. Sync context after the sandbox is ready.

Scaffold a project

Create a starter project against the selected environment.

dome quickstart my-agent-project

The command generates SDK setup, dome.yaml, environment placeholders, a Dockerfile, and starter Cedar rules.

Get started

Core concepts

Connect

Govern

Operate

Manage

Develop

Reference

Environments

Overview

Plans

Join policies

Sandboxes

Requirements

Permissions

Create a tenant

Create a workspace

Select a CLI context

Provision a sandbox

Scaffold a project

Next steps

​Overview

​Plans

​Join policies

​Sandboxes

​Requirements

​Permissions

​Create a tenant

​Create a workspace

​Select a CLI context

​Provision a sandbox

​Scaffold a project

​Next steps

Overview

Plans

Join policies

Sandboxes

Requirements

Permissions

Create a tenant

Create a workspace

Select a CLI context

Provision a sandbox

Scaffold a project

Next steps