`result=allowed` means the rules permitted the call. It doesn't mean the ticket closed.
Before retrying a call that timed out, check the backend. domesystems.ai/blog/how-to-a…
Quiet for 30 days doesn't mean unused. That agent may run quarterly.
Before you revoke one, ask the owner, check schedules and child agents, and find the credentials that live outside the gateway. domesystems.ai/blog/retire-a…
Shadow IT used to be a spreadsheet with macros. Now it's a spreadsheet with macros that calls a model.
An agent can stay under budget and finish nothing worth paying for.
Put retries and failed attempts in the cost, then divide by work someone accepted. The worksheet: domesystems.ai/blog/what-sho…
Agent demos: the agent books the flight.
Agents in production: the agent drafts the email, and someone reads it before it goes.
A lending agent that drafts credit memos in nCino is one call from changing the risk rating.
Same credentials. The difference is a rule on the call: drafts allowed, rating changes refused, credit pulls limited to the loan file.
domesystems.ai/industries/fi…
Support assistant, remote MCP server, three tools.
Approve ticket search. Block customer export. Hold note creation until you've tested a write that saves but never replies.
The review that gets you there: domesystems.ai/blog/mcp-serv…
Who owns an agent's rules?
Security: the forbids that apply everywhere.
Platform: the defaults for each pattern.
App team: the narrow permits for their own agent.
That's one split. What's yours?
One refund tool, three callers: an assistant acting for a frontline rep, the same assistant acting for a supervisor, and a nightly job.
An allow-list by tool name treats them identically. Yes to all three, or no to all three.
domesystems.ai/mcp-gateway
Most agent governance stops at the endpoints: gateway for tools, a router for models.
We're launching Dome this morning: one system for the code an agent ships, the tools it calls, and the model it reasons through.
domesystems.ai/updates/dome-…
