Skip to main content
On Dome, a platform admin owns tenancy boundaries, workspace membership, who may change shared systems, and whether the estate stays operable and auditable. You decide who can administer Dome. You do not usually write every Cedar rule or attach every backend — operators and security run day-to-day Connect and Govern work inside the boundaries you set.

Hand this to an AI agent. It provisions an admin sandbox, lists members, checks health, and exports audit.

Open in Cursor
In this tutorial, you will provision a disposable workspace, inspect membership, optionally assign a role, verify platform access and Gateway inventory, and export an audit snapshot. To do this, you will:
1

Provision a sandbox

Create a workspace you can safely administer and delete.
2

Inspect and assign membership

List members; set a role only if a real teammate email is available.
3

Check platform access

Confirm authentication and inspect the workspace’s Gateways.
4

Export an audit snapshot

Prove the compliance export pipeline runs.

​
Prerequisites

For this tutorial, you will need:
  • The Dome CLI installed and authenticated
  • Permission to provision a sandbox and manage workspace members (workspace admin, or a higher role that cascades — refer to Permissions concept)
This tutorial stays in the Manage lane. For backends and Gateways refer to Operator. For Cedar and day-to-day audit investigation refer to Security.

​
Provision a sandbox

Confirm the workspace reads sandbox-role-platform-admin.

​
Inspect and assign membership

List who is already on the workspace:
Each member holds one workspace role: admin, operator, security, or viewer (refer to Permissions concept). Assign a role only when you have a real teammate email that already exists in your org:
If you do not have a second user handy, skip this command. The rest of the tutorial still exercises health and export.

​
Check platform access

Confirm the CLI can reach the platform, then list the public Gateways in the active workspace:
Pair that inventory with a quick glance at recent audit activity:
An empty result is fine on a brand-new sandbox.

​
Export an audit snapshot

Platform admins prove the export pipeline works even when there is little traffic. Export today’s events as JSON Lines:
A zero-line file still means the command succeeded — you verified the path. Use --format ocsf or cef when a downstream SIEM expects those shapes.

​
Clean up

​
Next steps

You learned how to inspect membership, check gateway health, and export an audit snapshot. Continue with:
  • Operator to attach backends and expose Gateways
  • Security for Rules, Filters, and evidence packages
  • Permissions concept for the full role-to-capability map