Authorization Rules

Authorization rules tools manage Cedar policy bundles that govern what agents can do. Use these tools to deploy rules, validate syntax, simulate decisions before deploying, and roll back to previous versions. These 10 tools require workspace context.

Rules Deploy

dome_rules_deploy Deploy a bundle of Cedar authorization rules. Each file has a name and Cedar policy content. Defaults to workspace scope if scope_kind/scope_id are omitted. Use dome_agents_assign_policy for agent-scoped rules.

Parameter	Type	Required	Description
`files`	array	Yes	Array of `{name, content}` objects — Cedar rule files
`name`	string	No	Optional friendly display name for this rule bundle
`scope_kind`	string	No	Scope kind: `tenant`, `workspace`, `agent` (defaults to `workspace` if a workspace context is active)
`scope_id`	string	No	Scope ID (workspace or agent UUID)
`court_scope`	string	No	Directional Court-review marker: `none` (default), `reduce`, `expand`, or `both`

Permission: rules.deploy

Example tool call

{
  "name": "dome_rules_deploy",
  "arguments": {
    "files": [
      {
        "name": "allow-code-search.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource == Dome::MCPTool::\"code-search\"\n);"
      }
    ],
    "name": "allow-code-search"
  }
}

Cedar policies use a declarative syntax. Use dome_rules_validate to check syntax before deploying.

The response includes an advisory warnings array. After a successful deploy, the control plane walks every policy for Dome::MCPTool references and cross-checks each (connection, tool) pair against the workspace’s persisted MCP tool catalog. Mismatches surface as ValidationWarning entries (file + message) — a typo or rename is flagged, but the deploy still succeeds. Warnings are only emitted for workspace- and agent-scoped bundles; tenant-scoped deploys skip this check because the catalog is workspace-keyed.

Rules Get Active

dome_rules_get_active Get the currently active rule bundle at the specified scope. Defaults to workspace scope. For agent-specific rules, use scope_kind="agent" and scope_id=<agent-id>, or use dome_agents_get_policies.

Parameter	Type	Required	Description
`scope_kind`	string	No	Scope kind: `tenant`, `workspace`, `agent`
`scope_id`	string	No	Scope ID

Permission: rules.view

Rules Validate

dome_rules_validate Validate Cedar rule files without deploying. Returns errors and warnings.

Parameter	Type	Required	Description
`files`	array	Yes	Array of `{name, content}` objects — Cedar rule files

Permission: rules.view

Example tool call

{
  "name": "dome_rules_validate",
  "arguments": {
    "files": [
      {
        "name": "draft.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource\n);"
      }
    ]
  }
}

Rules Simulate

dome_rules_simulate Simulate an authorization decision against the active rules without actually performing the action.

Parameter	Type	Required	Description
`agent_id`	string	Yes	Agent ID (or name — resolved to UUID) to simulate as the caller
`action`	string	Yes	Action to evaluate (e.g., `mcp:call`, `mcp:discover`)
`resource`	string	Yes	Resource identifier
`resource_type`	string	Yes	Resource type: `mcp_tool`, `llm_model`, `resource`
`context`	object	No	Additional context key-value pairs
`actas_sub`	string	No	Act-as subject identifier (end-user the agent acts on behalf of)
`actas_email`	string	No	Act-as email
`actas_roles`	string	No	Act-as roles (comma-separated)
`actas_groups`	string	No	Act-as groups (comma-separated)

Permission: rules.view

Example tool call

{
  "name": "dome_rules_simulate",
  "arguments": {
    "agent_id": "code-reviewer",
    "action": "mcp:call",
    "resource": "mcp_tool/code-search",
    "resource_type": "mcp_tool"
  }
}

Rules Simulate Result

dome_rules_simulate_result Get the result of a rule simulation run. If the simulation is still running, the status is pending or running — call again after a moment to check for completion.

Parameter	Type	Required	Description
`id`	string	Yes	Simulation ID

Permission: rules.view

Rules List Versions

dome_rules_list_versions List historical rule bundle versions at the specified scope. Defaults to workspace scope.

Parameter	Type	Required	Description
`scope_kind`	string	No	Scope kind: `tenant`, `workspace`, `agent`
`scope_id`	string	No	Scope ID
`limit`	number	No	Maximum results (default: 20)

Permission: rules.view Returns each version with its bundle ID, name, deploy timestamp, and deployer.

Rules Rollback

dome_rules_rollback Rollback to a previously deployed rule bundle by its ID. The server reads the bundle’s scope from the stored row — no scope_kind/scope_id needed.

Parameter	Type	Required	Description
`bundle_id`	string	Yes	Bundle ID (UUID) from `dome_rules_list_versions`

Permission: rules.rollback

Rollback immediately changes the active rules. All subsequent authorization decisions use the rolled-back bundle.

Rules Generate

dome_rules_generate Generate starter Cedar authorization rules. Returns a Cedar policy with blanket mcp:discover permit and comments explaining how backend tool availability works.

Parameter	Type	Required	Description
—	—	—	No parameters

Permission: rules.view

Agents Assign Policy

dome_agents_assign_policy Deploy Cedar rules scoped to a specific agent. These rules are evaluated in addition to workspace-level rules. Cedar forbid at workspace scope overrides permit at agent scope.

Parameter	Type	Required	Description
`agent_id`	string	Yes	Agent ID to assign rules to
`files`	array	Yes	Array of `{name, content}` objects — Cedar rule files

Permission: rules.deploy

Example tool call

{
  "name": "dome_agents_assign_policy",
  "arguments": {
    "agent_id": "code-reviewer",
    "files": [
      {
        "name": "agent-policy.cedar",
        "content": "permit(\n  principal,\n  action == Dome::Action::\"mcp:call\",\n  resource == Dome::MCPTool::\"code-search\"\n);"
      }
    ]
  }
}

Agents Get Policies

dome_agents_get_policies Get the Cedar rules currently assigned to a specific agent (agent-scope only; does not include inherited workspace/tenant/org rules). To see workspace rules, use dome_rules_get_active.

Parameter	Type	Required	Description
`agent_id`	string	Yes	Agent ID

Permission: rules.view

Next steps

Write and simulate from Govern. Evaluation semantics and Cedar catalogs sit under Concepts and Reference:

Overview

Tools

Authorization Rules

Rules Deploy

Rules Get Active

Rules Validate

Rules Simulate

Rules Simulate Result

Rules List Versions

Rules Rollback

Rules Generate

Agents Assign Policy

Agents Get Policies

Next steps

​Rules Deploy

​Rules Get Active

​Rules Validate

​Rules Simulate

​Rules Simulate Result

​Rules List Versions

​Rules Rollback

​Rules Generate

​Agents Assign Policy

​Agents Get Policies

​Next steps

Rules Deploy

Rules Get Active

Rules Validate

Rules Simulate

Rules Simulate Result

Rules List Versions

Rules Rollback

Rules Generate

Agents Assign Policy

Agents Get Policies

Next steps