Operator

On Dome, an operator owns the shared substrate: workspaces, tool and model connections, Gateways, grants, and the live signals that show the platform is healthy. You make backends reachable under Dome, group them behind named endpoints, grant the right agents access at the edge, and watch traffic. Developers integrate agents into that substrate. Security tightens what those agents may do once they are on it.

In this tutorial, you will provision a sandbox, attach demo-hr to Default, grant a throwaway agent at the edge, and prove the substrate with one allowed call — then see it in audit.

To do this, you will:

Prerequisites

For this tutorial, you will need:

• The Dome CLI installed and authenticated
• A role that can provision a sandbox and attach tools (admin, operator, or equivalent — refer to Permissions concept)

Provision a sandbox

dome sandbox provision --scope=workspace --workspace-name role-operator
dome context sync
dome context use sandbox-role-operator
dome context current

Confirm the workspace reads sandbox-role-operator.

Attach a tool to Default

A tool is unreachable until it belongs to a Gateway. Register the public demo HR server on Default:

dome tools add \
  --name demo-hr \
  --url https://demo-mcp.domesystems.ai/mcp \
  --protocol streamable-http \
  --auth-method none \
  --gateway Default

Confirm Default lists the connection:

dome gateways get Default

Grant a smoke-test agent

Without an agent grant, nothing can call through the edge — even with a healthy backend. Register a disposable agent and admit it:

dome agents register --name role-ops-agent --if-not-exists
dome agents create-key role-ops-agent --name smoke
dome gateways access grant Default role-ops-agent

Save the token to a gitignored .env. Treat this agent as scaffolding for the smoke test, not a production workload identity.

Deploy a minimal allow

Gateway grants admit the agent; Cedar still decides each call. Deploy the smallest permit that lets one directory tool succeed:

permit(
  principal is Dome::Agent,
  action == Dome::Action::"mcp:discover",
  resource
);

permit(
  principal is Dome::Agent,
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"demo-hr/hr/list_employees"
);

dome rules apply role-ops-agent.cedar --agent role-ops-agent --name role-ops-agent

Smoke-test the substrate

dome context current
dome gateways list

export DOME_GATEWAY_URL="https://GATEWAY_HOST/gateways/DEFAULT_GATEWAY_ID"
export DOME_TOKEN="dome_..."

One allowed call proves backend membership, the grant, and Cedar together.

curl -sS -X POST "$DOME_GATEWAY_URL/mcp" \
  -H "Authorization: Bearer $DOME_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "demo-hr/hr/list_employees",
      "arguments": {}
    }
  }'

import json
import os

import httpx

url = os.environ["DOME_GATEWAY_URL"].rstrip("/") + "/mcp"
token = os.environ["DOME_TOKEN"]

response = httpx.post(
    url,
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
    },
    json={
        "jsonrpc": "2.0",
        "id": 1,
        "method": "tools/call",
        "params": {
            "name": "demo-hr/hr/list_employees",
            "arguments": {},
        },
    },
    timeout=30.0,
)
print(json.dumps(response.json(), indent=2))

python smoke_ops.py

Confirm the call landed in audit. Tail live events in a second terminal if you want the operator view:

dome audit query --limit 10
# Optional live tail:
# dome audit stream

Clean up

dome workspaces delete sandbox-role-operator

Next steps

You learned how to attach tools to a Gateway, grant access at the edge, and prove the substrate with a smoke call. Continue with:

• Developer to register real agent workloads and verify allow/deny
• Security to tighten Rules, Filters, and evidence export
• Stream Live Events for day-to-day triage