Workspaces

Create workspaces, manage members, and configure act-as enforcement and policy freshness

A workspace is the scope where day-to-day work lives: agents, resources, Gateways, Rules, Guards, Quotas, and audit events. Dome enforces workspace boundaries on every configuration and runtime request.

Refer to Environments for workspaces and sandboxes. Refer to Access for members.

These tools span three permission tiers: list and get are visible to any caller with an active context; member, act-as, freshness, and delete require workspace workspaces.manage or config.manage; create and sandbox provisioning require tenant- or org-level permissions.

Workspaces

dome_workspaces_list

List all workspaces in the current tenant.

Parameter	Type	Required	Description
—	—	—	No parameters

Authenticated only — visible to any caller with an active context. The server returns only the workspaces the caller actually has access to.

Example tool call

{
  "name": "dome_workspaces_list"
}

dome_workspaces_create

Create a new workspace in the current tenant. The server auto-generates a URL-safe slug from the display name.

Parameter	Type	Required	Description
`name`	string	Yes	Workspace display name
`join_policy`	string	No	How non-members join: `open`, `request`, or `invite_only`. Omit to take the server default (`invite_only`).

Requires tenant-level tenants.manage (held by tenant admin, or by org owner / admin via cascade). Workspace-only roles cannot create workspaces.

Example tool call

{
  "name": "dome_workspaces_create",
  "arguments": {
    "name": "staging",
    "join_policy": "request"
  }
}

Unknown join_policy values return InvalidArgument. See Join policies.

dome_workspaces_get

Get a single workspace in the current tenant. Accepts a UUID or a slug; defaults to the active workspace when omitted.

Parameter	Type	Required	Description
`workspace`	string	No	Workspace ID (UUID) or slug. Defaults to the active workspace.

Authenticated only — visible to any caller with an active context. The server enforces that the caller can read the requested workspace.

dome_workspaces_delete

Delete a workspace from the current tenant. Accepts a UUID or a slug. Marked destructive.

Parameter	Type	Required	Description
`workspace`	string	Yes	Workspace ID (UUID) or slug

Requires workspaces.manage.

Workspace deletion is permanent and cannot be undone.

Sandbox

dome_provision_sandbox

Provision a sandbox environment for development and testing. Use scope="tenant" to create an isolated sandbox tenant with workspace and API key (requires org admin/owner). Use scope="workspace" to create a sandbox workspace in the current tenant (requires tenant admin/operator/security).

Parameter	Type	Required	Description
`scope`	string	Yes	`tenant` or `workspace`
`tenant_name`	string	No	Sandbox tenant name suffix (auto-generated if omitted). Used only when `scope="tenant"`. Must be lowercase alphanumeric and hyphens, max 64 chars.
`workspace_name`	string	No	Sandbox workspace name suffix (auto-generated if omitted). Used with both scopes.

Requires tenant-level sandbox.workspaces.create for scope="workspace" (held by every tenant role, plus org owner / admin via cascade). Org-level sandbox.tenants.create for scope="tenant" (held by org owner / admin only).

Example — sandbox workspace

{
  "name": "dome_provision_sandbox",
  "arguments": {
    "scope": "workspace",
    "workspace_name": "integration-testing"
  }
}

Act-as

Act-as enforcement controls whether agents must present verified end-user identity on every request.

dome_workspaces_actas_get

Get the current act-as enforcement policy for the active workspace.

Parameter	Type	Required	Description
—	—	—	No parameters

Requires config.manage.

Returns whether act-as is required and which verification methods are allowed.

dome_workspaces_actas_update

Update the act-as enforcement policy for the active workspace.

Parameter	Type	Required	Description
`actas_required`	bool	No	Require act-as header on all requests
`actas_allowed_methods`	array	No	Allowed verification methods (e.g., `["oidc", "hmac"]`). Empty = any method.

Requires config.manage.

Example tool call

{
  "name": "dome_workspaces_actas_update",
  "arguments": {
    "actas_required": true,
    "actas_allowed_methods": ["oidc"]
  }
}

Enabling act-as enforcement affects all agents in the workspace. Agents without a configured act-as method are rejected.

Freshness

Each workspace has a configurable freshness window that bounds how long the gateway may serve cached authorization policy before failing closed. Default is 90 seconds; range is 30–86400 seconds. Enforcement is per-workspace — one workspace failing closed does not affect others.

dome_workspaces_set_freshness_window

Set the freshness window for the active workspace.

Parameter	Type	Required	Description
`seconds`	number	Yes	Freshness window in seconds (30–86400)

Requires config.manage.

Example tool call

{
  "name": "dome_workspaces_set_freshness_window",
  "arguments": {
    "seconds": 120
  }
}

Once the window elapses, the gateway denies governed requests until policy is fresh. The affected tool.call or model.call completes with result=denied and denial.reason=stale_policy; there is no separate staleness-denied event.

Members

dome_workspaces_members_list

List all members of the active workspace with their roles.

Parameter	Type	Required	Description
—	—	—	No parameters

Requires workspaces.manage.

Returns each member with their email, role, and join date.

dome_workspaces_members_set

Grant or update a user's role in the active workspace.

Parameter	Type	Required	Description
`user_email`	string	Yes	User email address
`role`	string	Yes	Role: `admin`, `operator`, `security`, `viewer`

Requires workspaces.manage.

Example tool call

{
  "name": "dome_workspaces_members_set",
  "arguments": {
    "user_email": "alice@example.com",
    "role": "operator"
  }
}

dome_workspaces_members_remove

Remove a user from the active workspace. Optionally revoke their API keys at the same time by passing revoke_key_ids (specific IDs) or revoke_all_keys=true. If neither is passed and the user has active keys, the response lists them so the caller can decide which to revoke. Marked destructive.

Parameter	Type	Required	Description
`user_email`	string	Yes	User email address
`revoke_key_ids`	array	No	API key IDs to revoke alongside the removal. Mutually exclusive with `revoke_all_keys`.
`revoke_all_keys`	bool	No	Revoke all API keys created by the user. Mutually exclusive with `revoke_key_ids`.

Requires workspaces.manage.

Next steps

Tenancy and membership how-tos live under Manage:

Workspaces

On this page