Rules

Rules are Cedar permit and forbid policies Dome evaluates on every governed tool or model request. They decide which calls an admitted agent may make after Gateway access.

Refer to Rules for how to write, validate, simulate, and apply Cedar bundles. All tools require workspace context.

Rules

dome_rules_deploy

Deploy a bundle of Cedar authorization rules. Each file has a name and Cedar policy content. Defaults to workspace scope if scope_kind/scope_id are omitted. Use dome_agents_assign_policy for agent-scoped rules.

{
  "name": "dome_rules_deploy",
  "arguments": {
    "files": [
      {
        "name": "allow-code-search.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource == Dome::MCPTool::\"code-search\"\n);"
      }
    ],
    "name": "allow-code-search"
  }
}

The response includes an advisory warnings array. After a successful deploy, the control plane walks every policy for Dome::MCPTool references and cross-checks each (connection, tool) pair against the workspace's persisted MCP tool catalog. Mismatches surface as ValidationWarning entries (file + message) — a typo or rename is flagged, but the deploy still succeeds. Warnings are only emitted for workspace- and agent-scoped bundles; tenant-scoped deploys skip this check because the catalog is workspace-keyed.

dome_rules_get_active

Get the currently active rule bundle at the specified scope. Defaults to workspace scope. For agent-specific rules, use scope_kind="agent" and scope_id=<agent-id>, or use dome_agents_get_policies.

dome_rules_validate

Validate Cedar rule files without deploying. Returns errors and warnings.

{
  "name": "dome_rules_validate",
  "arguments": {
    "files": [
      {
        "name": "draft.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource\n);"
      }
    ]
  }
}

dome_rules_generate

Generate starter Cedar authorization rules. Returns a Cedar policy with blanket mcp:discover permit and comments explaining how backend tool availability works.

Simulate

dome_rules_simulate

Simulate an authorization decision against the active rules without actually performing the action.

{
  "name": "dome_rules_simulate",
  "arguments": {
    "agent_id": "code-reviewer",
    "action": "mcp:call",
    "resource": "mcp_tool/code-search",
    "resource_type": "mcp_tool"
  }
}

dome_rules_simulate_result

Get the result of a rule simulation run. If the simulation is still running, the status is pending or running — call again after a moment to check for completion.

Versions

dome_rules_list_versions

List historical rule bundle versions at the specified scope. Defaults to workspace scope.

Returns each version with its bundle ID, name, deploy timestamp, and deployer.

dome_rules_rollback

Rollback to a previously deployed rule bundle by its ID. The server reads the bundle's scope from the stored row — no scope_kind/scope_id needed.

Agent policies

dome_agents_assign_policy

Deploy Cedar rules scoped to a specific agent. These rules are evaluated in addition to workspace-level rules. Cedar forbid at workspace scope overrides permit at agent scope.

{
  "name": "dome_agents_assign_policy",
  "arguments": {
    "agent_id": "code-reviewer",
    "files": [
      {
        "name": "agent-policy.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource == Dome::MCPTool::\"code-search\"\n);"
      }
    ]
  }
}

dome_agents_get_policies

Get the Cedar rules currently assigned to a specific agent (agent-scope only; does not include inherited workspace/tenant/org rules). To see workspace rules, use dome_rules_get_active.

Next steps

Write and simulate from Govern. Evaluation semantics and Cedar catalogs sit under Concepts and Reference:

• Authorize Access
• Authorization Model concept
• Rules reference