> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Use OIDC or bound act-as

> Replace sandbox HMAC act-as with an IdP JWT or a bound enrollment identity (coming soon)

<Info>
  This tutorial is coming soon.
</Info>

[Govern per end user](/tutorials/get-started/govern-per-end-user) teaches the pattern with HMAC: your **backend** holds the agent token, signs `X-Dome-Act-As`, and calls Dome. The frontend never sees either secret.

Production usually should not mint identities with a shared HMAC secret. This tutorial will cover the two stronger verification methods:

| Method    | When to use                         | What the backend sends                                                           |
| --------- | ----------------------------------- | -------------------------------------------------------------------------------- |
| **OIDC**  | End users sign in through your IdP  | The end-user JWT as `X-Dome-Act-As`. Dome verifies it against discovery metadata |
| **Bound** | The agent is enrolled to one person | No client act-as header. The platform injects the enrollment identity            |

Until this tutorial ships, use the HMAC sandbox path and the delegated-agent reference below.

## Next steps

Until this tutorial ships, use the HMAC path and the delegated-agent reference:

* [Govern per end user](/tutorials/get-started/govern-per-end-user) for the HMAC sandbox path
* [Delegated agents](/connect/agents/delegated) for OIDC providers, workspace policy, and methods
* [Pass identity for delegated agents](/develop#pass-identity-for-delegated-agents) in application code
* [Adopt an existing app](/tutorials/production/adopt-an-existing-app) to move a running app onto the governed path