> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Concise definitions for Dome's core entities and terms, with links to full coverage

export const workspace = "A workspace is the scope where day-to-day work lives: agents, resources, Gateways, Rules, Guards, Quotas, and audit events. Dome enforces workspace boundaries on every configuration and runtime request.";

export const webhook = "Webhooks deliver selected workspace events as signed HTTP POSTs to your HTTPS endpoint or a provider. A subscription chooses which events to send. A destination receives them.";

export const verificationProvider = "A verification provider tells Dome how to verify the end-user identity a delegated agent presents, typically OIDC or HMAC. Unverified act-as headers never become Cedar claims.";

export const toolsGateway = "The Tools gateway is Dome's MCP ingress for tool traffic at /gateways/<id>/mcp. Dome authenticates the agent, evaluates Rules, injects backend credentials, applies Guards, and audits each invocation.";

export const tool = "A tool is an MCP server (or related backend) you attach so agents can call it without holding upstream secrets. Dome authorizes each call, injects the credential, and audits the result.";

export const tenant = "A tenant is a hard isolation boundary inside an organization, usually drawn around a business unit or product line. Configuration and traffic never cross a tenant boundary.";

export const streamLiveEvents = "Stream live events shows governed traffic and live operational signals in real time. It reads the same Audit v1 trail as historical investigation, and can attribute LLM usage or export OpenTelemetry and product telemetry into your stack.";

export const standingIdentity = "Standing identity means the agent is the principal: it acts as itself and authorizes on its own grants. Use it when the workload needs the same permissions regardless of who triggered it.";

export const simulation = "Simulation replays candidate Rules against recorded authorization decisions to show which outcomes would change. Dome compares each historical event with the decision the candidate Rules would produce.";

export const settings = "Settings are workspace defaults for audit retention, policy refresh, and agent token lifetime inside an existing workspace.";

export const scope = "Scopes nest every governed object in four levels: organization, tenant, workspace, and agent. Policy inherits down the tree; isolation and audit attach at each level.";

export const ruleBundle = "A rule bundle is a versioned set of Cedar Rules deployed at organization, tenant, workspace, or agent scope. Dome merges bundles from all scopes into one effective policy evaluated on every request.";

export const rule = "Rules are Cedar permit and forbid policies Dome evaluates on every governed tool or model request. They decide which calls an admitted agent may make after Gateway access.";

export const resource = "A resource is something an agent calls through Dome: a tool, a model connection, or a pool. Dome stores upstream endpoints and credentials and injects them on each outbound call.";

export const quota = "A Quota caps governed LLM spend in USD over a daily or monthly window for a workspace, agent, Gateway, pool, or model. Dome rejects or reroutes metered calls when the budget is exhausted.";

export const platformApiKey = "A platform API key authenticates automation against the Dome API for administration tasks. Scope a key to workspace, tenant, or org. It does not authorize agent tool or model calls.";

export const permissions = "Permissions split platform administration from runtime agent access. RBAC governs people and API clients. Rules govern agent requests to tools and models.";

export const organization = "An organization is a company's top-level account in Dome. An organization contains one or more tenants.";

export const modelPool = "A pool groups multiple model connections behind one name. Agents request the pool by name. Dome routes, load-balances, and fails over across members.";

export const modelConnection = "A model (model connection) is one upstream LLM endpoint agents call through a Gateway. Dome routes the request, injects the provider credential, applies Rules and Guards, and records the result.";

export const membership = "Membership is the inclusion of a resource in a Gateway. An agent can reach a resource only when that resource is a member of a Gateway the agent has access to.";

export const llmGateway = "The LLM gateway is Dome's model ingress for OpenAI- and Anthropic-shaped requests at /gateways/<id>/v1/*. Dome authorizes each call, resolves a model or pool, injects provider credentials, applies Guards, and audits the result.";

export const integrations = "Integrations connect Dome to your enterprise identity and secret storage. Dome authenticates platform users and stores credentials used at egress.";

export const identityPatterns = "Identity patterns decide whether an agent authorizes as itself (standing) or as a verified person it acts for (delegated). The choice determines which grants Cedar evaluates and how audit attributes each call.";

export const guard = "Guards inspect request and response content on tool and model connections. They can redact, omit, or block sensitive text before it reaches an agent or upstream backend.";

export const gateways = "A Gateway is a named access surface that lists which tools and models an agent may reach and exposes one stable URL for that set. Dome checks membership and access grants before Rules run on each call.";

export const filter = "A Filter is the Guard type. It inspects request or response content on a tool or model connection and can redact, omit, or block matching text.";

export const environment = "An environment in Dome is the place platform work runs: a tenant for hard isolation, a workspace for day-to-day operations, and a CLI context that points tools at that workspace.";

export const egressHeader = "An egress header is a value the gateway adds on the outbound request to an upstream tool. It can be a literal, a stored secret, or the verified act-as identity.";

export const effectiveRules = "Effective Rules are the merged set of every active Rule bundle that covers an agent, including generated bundles. Dome evaluates that set on each governed request.";

export const delegatedAgent = "A delegated agent acts for a verified person. Dome verifies the end-user identity on each request so Rules, Quotas, and audit can authorize on that human.";

export const dataPlane = "The data plane is the runtime between agents and the tools and models behind a Gateway. It authenticates each caller, evaluates authorization, injects upstream credentials, and records the outcome before traffic reaches a backend.";

export const dataExport = "Export configures destinations, schedules, and forwarder health so retained audit records reach your SIEM or object store.";

export const controlPlane = "The control plane is where you configure Dome: agents, resources, Gateways, Rules, Guards, Quotas, and platform settings. That configuration syncs to the data plane, which enforces it on every request.";

export const cedarAssistant = "The Rules assistant drafts and refines Dome authorization Rules from natural language in the dashboard Rules editor. Dome validates each draft and routes assistant calls through the Model Broker like any other agent.";

export const cedar = "Cedar is the deterministic policy language Dome uses to author authorization Rules. It evaluates the agent, action, resource, and context, and fails closed when a decision cannot be made.";

export const capability = "A capability is a permission string declared on an agent and carried in its token, such as mcp:call or llm:invoke. Capabilities describe the classes of action an agent may attempt. Cedar Rules then authorize each specific request.";

export const authorizationModel = "The authorization model is how Dome decides whether an agent may call a tool or model. Dome evaluates Cedar permit and forbid policies against a typed entity model on every governed request. Any matching forbid denies the request, and when no rule matches, the request is denied.";

export const auditEvent = "Audit events are the durable evidence trail for every governed action in a workspace. Each event records who acted, on what, under which scope, and with what result.";

export const apiKey = "An API key is a long-lived credential an agent exchanges at runtime for a short-lived token. Keys are issued once and cannot be retrieved again. Rotate or revoke a key to cut off access.";

export const agentLifecycle = "Agent lifecycle is the state graph for a registered agent: provisioned, active, suspended, and revoked. State decides whether the identity may send traffic and hold active credentials.";

export const agentIdentity = "Agent identity is how Dome authenticates the caller on every governed request. An API key exchanges for a short-lived session token; optional act-as claims carry verified end-user context.";

export const agent = "An agent is an identity in Dome that represents an application, assistant, or automated process making requests. Dome authenticates, authorizes, and audits each agent's calls to tools and models.";

export const actAs = "Act-as is a verified assertion of the end user an agent acts for, carried on the X-Dome-Act-As header. Authorization and audit evaluate against that person's identity, so the same agent can be allowed for one person and denied for another.";

export const accessGrant = "An access grant is permission for an agent to use a Gateway. A grant can name a specific agent or cover every agent in the workspace. Membership and Rules still apply after the grant.";

export const access = "Access controls who can administer a workspace and which operations automation can perform through the Dome API. Platform memberships and platform API keys grant administration permissions separate from agent runtime authorization.";

The core terms you'll meet across Dome, each with a one-line definition and a link to the page that covers it in depth.

### Access

<p>
  {access}
</p>

**Related:** [Manage access](/manage/access) · [Permissions](/concepts/platform/permissions) concept

### Access grant

<p>
  {accessGrant}
</p>

**Related:** [Architecture](/concepts/architecture#gateways) concept · [Gateways](/connect/gateways)

### Act-as

<p>
  {actAs}
</p>

**Related:** [Delegated agents](/connect/agents/delegated) · [Identity Patterns](/concepts/identity-patterns) concept

### Agent

<p>
  {agent}
</p>

**Related:** [Agents](/concepts/agents) concept · [Agent Identity](/concepts/agents/identity) concept · [Agents](/connect/agents)

### Agent identity

<p>
  {agentIdentity}
</p>

**Related:** [Agent Identity](/concepts/agents/identity) concept · [Agents](/connect/agents) · [Identity Patterns](/concepts/identity-patterns) concept

### Agent lifecycle

<p>
  {agentLifecycle}
</p>

**Related:** [Agent lifecycle](/concepts/agents/agent-lifecycle) concept · [Agents](/connect/agents)

### API key

<p>
  {apiKey}
</p>

**Related:** [Agent Identity](/concepts/agents/identity) concept · [Agents](/connect/agents)

### Audit event

<p>
  {auditEvent}
</p>

**Related:** [Audit events](/concepts/audit) concept · [Audit events](/operate/audit)

### Authorization model

<p>
  {authorizationModel}
</p>

**Related:** [Authorization Model](/concepts/architecture/authorization-model) concept · [Rules](/govern/rules) · [Rules](/reference/controls/rules) reference

### Capability

<p>
  {capability}
</p>

**Related:** [Agent Identity](/concepts/agents/identity) concept · [Authorization Model](/concepts/architecture/authorization-model) concept

### Cedar

<p>
  {cedar}
</p>

**Related:** [Authorization Model](/concepts/architecture/authorization-model) concept · [Rules](/govern/rules)

### Rules assistant

<p>
  {cedarAssistant}
</p>

**Related:** [Rules assistant](/govern/rules/assistant) · [Rules](/govern/rules)

### Control plane

<p>
  {controlPlane}
</p>

**Related:** [Architecture](/concepts/architecture) concept · [Data plane](/concepts/architecture/dataplane) concept

### Data plane

<p>
  {dataPlane}
</p>

**Related:** [Data plane](/concepts/architecture/dataplane) concept · [Architecture](/concepts/architecture#how-requests-move-through-dome) concept

### Delegated agent

<p>
  {delegatedAgent}
</p>

**Related:** [Delegated agents](/connect/agents/delegated) · [Identity Patterns](/concepts/identity-patterns) concept · [Act-as](/reference/glossary#act-as)

### Effective Rules

<p>
  {effectiveRules}
</p>

**Related:** [Rules](/concepts/controls/rules) concept · [Authorize Access](/govern/rules) · [Authorization Model](/concepts/architecture/authorization-model) concept

### Egress header

<p>
  {egressHeader}
</p>

**Related:** [Tools](/concepts/resources/tools) concept · [Tools](/connect/resources/tools)

### Environment

<p>
  {environment}
</p>

**Related:** [Prepare environments](/manage/environments) · [Scope hierarchy](/concepts/platform/scopes) concept

### Export

<p>
  {dataExport}
</p>

**Related:** [Export data](/manage/export) · [Audit events](/operate/audit)

### Filter

<p>
  {filter}
</p>

**Related:** [Guards](/concepts/controls/guards) concept · [Configure Guards](/govern/guards)

### Gateways

<p>
  {gateways}
</p>

**Related:** [Gateways](/concepts/gateways) concept · [Gateways](/connect/gateways)

### Guard

<p>
  {guard}
</p>

**Related:** [Guards](/concepts/controls/guards) concept · [Configure Guards](/govern/guards) · [Architecture](/concepts/architecture#guards) concept

### Identity patterns

<p>
  {identityPatterns}
</p>

**Related:** [Identity Patterns](/concepts/identity-patterns) concept · [Delegated agents](/connect/agents/delegated)

### Integrations

<p>
  {integrations}
</p>

**Related:** [Integrate systems](/manage/integrations)

### LLM gateway

<p>
  {llmGateway}
</p>

**Related:** [LLM gateway](/concepts/gateways/llm-gateway) concept · [Data plane](/concepts/architecture/dataplane) concept

### Membership

<p>
  {membership}
</p>

**Related:** [Architecture](/concepts/architecture#gateways) concept · [Gateways](/connect/gateways)

### Model connection

<p>
  {modelConnection}
</p>

**Related:** [Models](/concepts/resources/models) concept · [Models](/connect/resources/models) · [LLM gateway](/concepts/gateways/llm-gateway) concept

### Organization

<p>
  {organization}
</p>

**Related:** [Scope hierarchy](/concepts/platform/scopes) concept

### Permissions

<p>
  {permissions}
</p>

**Related:** [Permissions](/concepts/platform/permissions) concept · [Manage access](/manage/access)

### Platform API key

<p>
  {platformApiKey}
</p>

**Related:** [Manage access](/manage/access) · [Permissions](/concepts/platform/permissions) concept

### Pool

<p>
  {modelPool}
</p>

**Related:** [Pools](/concepts/resources/model-pools) concept · [Pools](/connect/resources/models/pools) · [LLM gateway](/concepts/gateways/llm-gateway) concept

### Quota

<p>
  {quota}
</p>

**Related:** [Quotas](/concepts/controls/quotas) concept · [Set Usage Limits](/govern/quotas) · [Architecture](/concepts/architecture#quotas) concept

### Resource

<p>
  {resource}
</p>

**Related:** [Resources](/concepts/resources) concept · [Architecture](/concepts/architecture#resources) concept · [Connect](/connect)

### Rule

<p>
  {rule}
</p>

**Related:** [Rules](/govern/rules) · [Authorization Model](/concepts/architecture/authorization-model) concept

### Rule bundle

<p>
  {ruleBundle}
</p>

**Related:** [Rules](/govern/rules)

### Scope

<p>
  {scope}
</p>

**Related:** [Scope hierarchy](/concepts/platform/scopes) concept

### Settings

<p>
  {settings}
</p>

**Related:** [Configure platform](/manage/settings)

### Simulation

<p>
  {simulation}
</p>

**Related:** [Simulate rules](/govern/rules/simulate) · [Rules](/govern/rules)

### Standing identity

<p>
  {standingIdentity}
</p>

**Related:** [Identity Patterns](/concepts/identity-patterns) concept · [Agents](/connect/agents)

### Stream Live Events

<p>
  {streamLiveEvents}
</p>

**Related:** [Stream Live Events](/operate/observe) · [Audit events](/concepts/audit) concept · [Events](/reference/events) reference

### Tenant

<p>
  {tenant}
</p>

**Related:** [Scope hierarchy](/concepts/platform/scopes) concept

### Tool

<p>
  {tool}
</p>

**Related:** [Tools](/concepts/resources/tools) concept · [Tools](/connect/resources/tools) · [Architecture](/concepts/architecture#resources) concept

### Tools gateway

<p>
  {toolsGateway}
</p>

**Related:** [Tools gateway](/concepts/gateways/tools-gateway) concept · [Data plane](/concepts/architecture/dataplane) concept

### Verification provider

<p>
  {verificationProvider}
</p>

**Related:** [Delegated agents](/connect/agents/delegated) · [Identity Patterns](/concepts/identity-patterns) concept

### Webhook

<p>
  {webhook}
</p>

**Related:** [Webhooks](/operate/webhooks) · [Webhooks](/concepts/audit/webhooks) concept

### Workspace

<p>
  {workspace}
</p>

**Related:** [Scope hierarchy](/concepts/platform/scopes) concept

## Next steps

Definitions stay short on purpose. Concepts carry the full model:

* [Core Concepts](/concepts) for how Dome's pieces fit together
* [What is Dome?](/what-is-dome) for platform purpose
* [Quickstart](/quickstart) to register an agent and verify governed traffic