Glossary
Concise definitions for Dome's core entities and terms, with links to full coverage
The core terms you'll meet across Dome, each with a one-line definition and a link to the page that covers it in depth.
Access
Access controls who can administer a workspace and which operations automation can perform through the Dome API. Platform memberships and platform API keys grant administration permissions separate from agent runtime authorization.
Related: Manage access · Permissions concept
Access grant
An access grant is permission for an agent to use a Gateway. A grant can name a specific agent or cover every agent in the workspace. Membership and Rules still apply after the grant.
Related: Architecture concept · Gateways
Act-as
Act-as is a verified assertion of the end user an agent acts for, carried on the X-Dome-Act-As header. Authorization and audit evaluate against that person's identity, so the same agent can be allowed for one person and denied for another.
Related: Delegated agents · Identity Patterns concept
Agent
An agent is an identity in Dome that represents an application, assistant, or automated process making requests. Dome authenticates, authorizes, and audits each agent's calls to tools and models.
Related: Agents concept · Agent Identity concept · Agents
Agent identity
Agent identity is how Dome authenticates the caller on every governed request. An API key exchanges for a short-lived session token; optional act-as claims carry verified end-user context.
Related: Agent Identity concept · Agents · Identity Patterns concept
Agent lifecycle
Agent lifecycle is the state graph for a registered agent: provisioned, active, suspended, and revoked. State decides whether the identity may send traffic and hold active credentials.
Related: Agent lifecycle concept · Agents
Agent Registry
The Agent Registry is Dome's catalog of agent identities: who they are, their lifecycle, and their credentials. You manage it as Agents in the dashboard. Rules, Gateways, quotas, and audit all attach to a registered agent.
Related: Agents concept · Agents · Architecture concept
API key
An API key is a long-lived credential an agent exchanges at runtime for a short-lived token. Keys are issued once and cannot be retrieved again. Rotate or revoke a key to cut off access.
Related: Agent Identity concept · Agents
Audit event
Audit events are the durable evidence trail for every governed action in a workspace. Each event records who acted, on what, under which scope, and with what result.
Related: Audit events concept · Audit events
Authorization model
The authorization model is how Dome decides whether an agent may call a tool or model. Dome evaluates Cedar permit and forbid policies against a typed entity model on every governed request. Any matching forbid denies the request, and when no rule matches, the request is denied.
Related: Authorization Model concept · Rules · Rules reference
Caller
A Caller is a verified end-user identity observed behind delegated Act-As traffic. Dome projects Callers from audit evidence so you can inspect their identity, verification methods, and attributed agent activity.
Related: Callers · Delegated agents · Identity Patterns concept
Cedar
Cedar is the deterministic policy language Dome uses to author authorization Rules. It evaluates the agent, action, resource, and context, and fails closed when a decision cannot be made.
Related: Authorization Model concept · Rules
Control plane
The control plane is where you configure Dome: agents, resources, Gateways, Rules, Guards, Quotas, and platform settings. That configuration syncs to the data plane, which enforces it on every request.
Related: Architecture concept · Data plane concept
Data plane
The data plane is the runtime between agents and the tools and models behind a Gateway. It authenticates each caller, evaluates authorization, injects upstream credentials, and records the outcome before traffic reaches a backend.
Related: Data plane concept · Architecture concept
Delegated agent
A delegated agent acts for a verified person. Dome verifies the end-user identity on each request so Rules, Quotas, and audit can authorize on that human.
Related: Delegated agents · Identity Patterns concept · Act-as
Effective Rules
Effective Rules are the merged set of every active Rule bundle that covers an agent, including generated bundles. Dome evaluates that set on each governed request.
Related: Rules concept · Authorize Access · Authorization Model concept
Egress header
An egress header is a value the gateway adds on the outbound request to an upstream tool. It can be a literal, a stored secret, or the verified act-as identity.
Related: Tools concept · Tools
Environment
An environment in Dome is the place platform work runs: a tenant for hard isolation, a workspace for day-to-day operations, and a CLI context that points tools at that workspace.
Related: Prepare environments · Scope hierarchy concept
Export
Export configures batch destinations, schedules, and forwarder health so retained audit records reach your SIEM or object store. Continuous SIEM streaming is a separate forward-only path.
Related: Export data · Audit events
Filter
A Filter is a Guard type that inspects request or response content on a tool or model connection and can redact, omit, or block matching text.
Related: Guards concept · Configure Guards
Gateways
A Gateway is a named access surface that lists which tools and models an agent may reach and exposes one stable URL for that set. Dome checks membership and access grants before Rules run on each call.
Related: Gateways concept · Gateways
Guard
Guards inspect request and response content on tool and model connections. Filters can redact, omit, or block matching text. Validators block tool traffic when structured checks fail.
Related: Guards concept · Configure Guards · Guards reference
Identity patterns
Identity patterns decide whether an agent authorizes as itself (standing) or as a verified person it acts for (delegated). The choice determines which grants Cedar evaluates and how audit attributes each call.
Related: Identity Patterns concept · Delegated agents
Interactive OAuth
Interactive OAuth lets an authorized person use an interactive-enabled agent from an MCP client. The flow issues a short-lived Gateway token backed by a revocable interactive grant; it does not add the person to the Callers registry.
Related: Identity Patterns concept · Agents CLI · Interactive grant MCP tools
Integrations
Integrations connect Dome to your enterprise identity and secret storage. Dome authenticates platform users and stores credentials used at egress.
Related: Integrate systems
LLM gateway
The LLM gateway is Dome's model ingress for OpenAI- and Anthropic-shaped requests at /gateways/<id>/v1/*. Dome authorizes each call, resolves a model or pool, injects provider credentials, applies Guards, and audits the result.
Related: LLM gateway concept · Data plane concept · Model Broker
Membership
Membership is the inclusion of a resource in a Gateway. An agent can reach a resource only when that resource is a member of a Gateway the agent has access to.
Related: Architecture concept · Gateways
Model Broker
The Model Broker is how Dome governs model calls: authorize the request, resolve a model or pool, inject provider credentials, apply Guards and Quotas, and audit the result. Agents reach it through a Gateway; the LLM gateway is the HTTP ingress for that path.
Related: Models · LLM gateway concept · Architecture concept
Model connection
A model (model connection) is one upstream LLM endpoint agents call through a Gateway. Dome routes the request, injects the provider credential, applies Rules and Guards, and records the result.
Related: Models concept · Models · LLM gateway concept
Organization
An organization is a company's top-level account in Dome. An organization contains one or more tenants.
Related: Scope hierarchy concept
Permissions
Permissions split platform administration from runtime agent access. RBAC governs people and API clients. Rules govern agent requests to tools and models.
Related: Permissions concept · Manage access
Platform API key
A platform API key authenticates automation against the Dome API for administration tasks. Scope a key to workspace, tenant, or org. It does not authorize agent tool or model calls.
Related: Manage access · Permissions concept
Pool
A pool groups multiple model connections behind one name. Agents request the pool by name. Dome routes, load-balances, and fails over across members.
Related: Pools concept · Pools · LLM gateway concept
Quota
A Quota caps governed LLM spend in USD over a daily or monthly window for a workspace, agent, Gateway, pool, or model. Dome rejects or reroutes metered calls when the budget is exhausted.
Related: Quotas concept · Set Usage Limits · Architecture concept
Resource
A resource is something an agent calls through Dome: a tool, a model connection, or a pool. Dome stores upstream endpoints and credentials and injects them on each outbound call.
Related: Resources concept · Architecture concept · Connect
Rule
Rules are Cedar permit and forbid policies Dome evaluates on every governed tool or model request. They decide which calls an admitted agent may make after Gateway access.
Related: Rules · Authorization Model concept
Rule bundle
A rule bundle is a versioned set of Cedar Rules deployed at organization, tenant, workspace, or agent scope. Dome merges bundles from all scopes into one effective policy evaluated on every request.
Related: Rules
Rules assistant
The Rules assistant drafts and refines Dome authorization Rules from natural language in the dashboard Rules editor. Dome validates each draft and routes assistant calls through the Model Broker like any other agent.
Related: Rules assistant · Rules
Scope
Scopes nest every governed object in four levels: organization, tenant, workspace, and agent. Policy inherits down the tree; isolation and audit attach at each level.
Related: Scope hierarchy concept
Settings
Settings are workspace defaults for audit retention, policy refresh, and rule-bundle history inside an existing workspace.
Related: Configure platform
Simulation
Simulation replays candidate Rules against recorded authorization decisions to show which outcomes would change. Dome compares each historical event with the decision the candidate Rules would produce.
Related: Simulate rules · Rules
Standing identity
Standing identity means the agent is the principal: it acts as itself and authorizes on its own grants. Use it when the workload needs the same permissions regardless of who triggered it.
Related: Identity Patterns concept · Agents
Stream Live Events
Stream live events shows governed traffic and live operational signals in real time. It reads the same Audit v1 trail as historical investigation, and can attribute LLM usage or export OpenTelemetry and product telemetry into your stack.
Related: Stream Live Events · Audit events concept · Event catalog reference
Tenant
A tenant is a hard isolation boundary inside an organization, usually drawn around a business unit or product line. Configuration and traffic never cross a tenant boundary.
Related: Scope hierarchy concept
Tool
A tool is an MCP server (or related backend) you attach so agents can call it without holding upstream secrets. Dome authorizes each call, injects the credential, and audits the result.
Related: Tools concept · Tools · Architecture concept
Tools gateway
The Tools gateway is Dome's MCP ingress for tool traffic at /gateways/<id>/mcp. Dome authenticates the agent, evaluates Rules, injects backend credentials, applies Guards, and audits each invocation.
Related: Tools gateway concept · Data plane concept
Validator
A Validator is a Guard type for tool connections. It checks structured conditions on tool request arguments or MCP tool results and blocks when any condition fails. Validators never rewrite content.
Related: Guards concept · Configure Guards · Guards reference
Verification provider
A verification provider tells Dome how to verify the end-user identity a delegated agent presents, typically OIDC or HMAC. Unverified act-as headers never become Cedar claims.
Related: Delegated agents · Identity Patterns concept
Webhook
Webhooks deliver selected workspace events as signed HTTP POSTs to your HTTPS endpoint or a provider. A subscription chooses which events to send. A destination receives them.
Related: Webhooks · Webhooks concept
Workspace
A workspace is the scope where day-to-day work lives: agents, resources, Gateways, Rules, Guards, Quotas, and audit events. Dome enforces workspace boundaries on every configuration and runtime request.
Related: Scope hierarchy concept
Next steps
Definitions stay short on purpose. Concepts carry the full model:
- Core Concepts for how Dome's pieces fit together
- What is Dome? for platform purpose
- Quickstart to register an agent and verify governed traffic