Dome Systems
Dashboard
DocsLearnHands-on LabsTemplatesHelpChangelogCLIAPIMCPSDKs

Audit Expenses

Analyze expense evidence and surface potential exceptions without approving or changing records.

User
Caller
  • chat
App
Agent
  • audit-expenses-analyst
Governance
Gateway
  • audit-expenses-readonly
Pool

audit-expenses-pool

  • audit-expenses-model
Tools

ramp

    Tools

    brex

      Tools

      mercury

        Tools

        plaid

          What this template gives you

          • Interface

            A chat window, in your browser

            Use the included interface to send a request to this template.

          • Gateway

            audit-expenses-readonly gateway

            This template sends its requests through audit-expenses-readonly gateway, where its access rules and limits apply.

          • Model

            audit-expenses-model

            This template uses audit-expenses-model through the audit-expenses-pool pool.

          Usage

          Hand this template to an AI agent to set up this template

          Node.js and npm to run npx.

          Dome CLI, installed with brew install dome-systems/tap/dome, then signed in with dome auth login.

          Docker Compose to run the companion app locally.

          1. 1

            Create a workspace

            dome workspaces create --name <workspace-name>

            The CLI creates and selects a workspace context for you.

          2. 2

            Confirm the workspace context

            dome context list

            The workspace you just created is already selected.

          3. 3

            Pull the template

            npx @domesystems/templates pull dome-systems/audit-expenses@0.1.1 --dir audit-expenses

            Downloads this immutable release and verifies its digest.

          4. 4

            Run the template

            npx @domesystems/templates up --dir audit-expenses

            Imports it into Dome and starts the companion app.

          Dome import variables

          npx @domesystems/templates up imports the template into Dome and prompts for required values. For unattended runs, set them as DOME_IMPORT_VAR_… environment variables.

          Required values

          • DOME_IMPORT_VAR_anthropic_api_key

          Setup guide

          Follow this template's setup guidance for agent variables and upstream connections.

          # Set up Audit Expenses

This is a read-only composite, but it needs a model credential and every listed data source configured before it can run. Set up isolated test accounts or workspaces first, grant only the smallest read scope that exposes the test data, and store every credential only in Dome's secret inputs. Never put a key or secret in this repository, an agent prompt, or a chat message.

## Create the model credential

- Create an API key in the [Anthropic Console](https://console.anthropic.com/settings/keys).
- Enter the raw key as `anthropic_api_key` during import. Do not prepend `Bearer `.
- The template uses that key only for its managed `claude-sonnet-5` model connection.

## Create the provider credentials

- No provider secret is required before import. The connected providers below use browser OAuth with Dynamic Client Registration.

For a provider that asks you to register a manual OAuth app, use this callback URL exactly:

`https://api.domesystems.ai/oauth/callback`

## Set up each connected provider

### Ramp

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test user with reporting access only. Do not connect an identity that can approve expenses, reimburse, create cards, or change controls.

### Brex

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Before connecting, a Brex account or card admin must accept the Developer API agreement in **Settings → Developer** and enable **Brex in AI assistants** under **Settings → Beta features**. The MCP server then registers the OAuth client dynamically; authorize a test Brex user with reporting access only. Do not use an identity that can issue cards, approve expenses, move money, or change policies.

### Mercury

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test Mercury user with minimum account-viewing access. Do not connect an identity that can originate or approve transfers or administer accounts.

### Plaid

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test Plaid dashboard user with the lowest role needed for the intended account and connection data. Treat returned financial information as sensitive.

## Import and verify

1. Import the template and provide the values above.
2. Complete every browser OAuth flow with the intended dedicated test user. Token-based sources do not open a browser.
3. Open **Tools**, refresh discovery, and confirm every connection is attached to the template gateway.
4. Run the managed agent against known test data. Treat the template as verified only when the run succeeds **and calls at least one expected read-only tool**.

If a connection is unreachable, check the provider section above for its callback, API/MCP enablement, token prefix, consent scopes, and user/workspace access before retrying.

          Runtime environment

          These variables are required to run the agent. During pull, .env.example is copied to .env when available. If they’re missing, npx @domesystems/templates up retrieves them from Dome and saves them in .env. Pass --provision to refresh them.

          DOME_TOKEN=
DOME_GATEWAY_URL=

          Agent instructions

          You are Audit Expenses, a read-only assistant. Analyze expense evidence and surface potential exceptions without approving or changing records.

Use connected tools only to retrieve information. Do not invoke tools that create, update, delete, send, approve, or change upstream state, even if a provider exposes them. Produce a clear answer with source-specific evidence, confidence, assumptions, and recommended human next steps. When an action is needed, draft or recommend it for a person to perform; do not perform it.