Domains

Domains is the workspace for creating, configuring, archiving, and restoring data domains. Open Domains from the global application rail; the Settings gear does not open Domain configuration.

What's on this screen

A persistent list groups readable Domains under Pending, Active, Locked, Archived, and, when present, Archiving or Deleting. Each row also shows resource readiness as Failed, Stale, Pending, or Ready. Lifecycle and readiness are separate: a Domain can be Active while a resource needs attention.

The selected Domain shows these tabs according to your access:

Tab	What it contains
General	Identity, Domain Instructions, budget, Import or Export, and lifecycle actions
Resources	Single-open Git Repository, Data Platform, and Secret Store rows, with readiness and Reconcile
Secrets	Internal secret names, properties, versions and lifecycle actions; visible after saving Internal and when you have metadata access
dbt Docs	Generated documentation from the latest successful production publish
Service Principals	Domain-scoped service identities
Plugins	Installed Plugin assignments for the Domain
Automations	Domain jobs, schedules, and run history
Usage	Read-only usage estimates for the selected Domain

Human Domain access is managed only under Organization Settings Users. Intents, including retained deleted Intents, remain in the Intent workspace. The Domains workspace has no Sources or Intents tab and no Organization Settings shortcut.

When you open Domains, a landing page lets you select a Domain from the sidebar or start a new one. An empty workspace prompts you to create your first Domain. Direct links to a Domain still open that Domain.

How to create a Domain

1. Open Domains and select Add Domain, or choose an example card to prefill an editable name, icon, and description. Custom Domain starts blank.
2. Complete Basics, Data Platform, and Secret Store. Basics includes the repository; Data Platform includes Workspace. Back and direct step selection preserve the draft.
3. Once all three pages are complete, select Create Domain from any page. Studio creates the Domain once, selects it, and opens General.

There is no default-branch field or Add Resource action. Studio binds the repository's existing default branch and the selected platform resources.

Leaving creation after changing the draft asks whether to discard it. An untouched draft closes immediately. Changing the Data Platform Type preserves Basics and resets platform-specific authentication and resource fields.

Basics

Enter Name, choose an icon, and optionally add Description. After creation, you can add Domain Instructions in General using a plain multiline text field. Both optional fields are compact and resizable. The slug is derived from the name and cannot be changed after creation.

Choose Account / organization and Repository, then select Continue to Data Platform. If all three pages are already complete, this button shows Create Domain instead. Review the live Domain summary beside the form. If an edit makes the draft incomplete, the button returns to Continue; on Secret Store, Create Domain becomes disabled. Unchosen resources read Not configured; this is not a validation failure.

Data Platform and Workspace

Choose Data Platform Type, User authentication, and the displayed service authentication option. OAuth/OIDC choices list only Identity Providers already connected under User Settings → Connections; creation does not start OAuth.

Client ID and Client secret appear only for Dedicated identity. Reuse User Identity Provider uses the selected provider without separate credential entry. Select Continue to workspace to collapse authentication and open the resource choices. Reopen a section by selecting its header.

In Workspace, select a listed resource or explicitly choose the exact-identifier option where the dropdown supports it. Typing a filter alone does not select it. Fabric lets you choose an existing Workspace and Lakehouse or Warehouse, then a Schema and Ephemeral Workspace Capacity. MotherDuck lets you choose a Database and Schema. DuckDB Local lets you choose an existing Database, create a managed database file, or upload one existing DuckDB database, then a Schema. Workspace and Lakehouse creation are not available here.

To upload a DuckDB database:

1. In Workspace, select Choose file and select one non-empty .duckdb file.
2. Confirm the filename and size, then select Upload file. Files can be up to 1 GiB. If the transfer is interrupted, Studio keeps its saved progress for 24 hours and resumes from that progress when you retry.
3. Wait for Validating database and then Uploaded and selected. Choose a schema to continue. Studio checks that the file is a readable DuckDB database.
4. Select or create the Schema, then continue creating the Domain.

Studio never replaces a managed database file with the same name. If that name is already in use, choose a differently named file. Select Cancel to clear the selected file and stop an unfinished upload.

Searchable lists filter by any case-insensitive part of the visible name without changing the selection. No matching options means only that the filter found no match; it is different from loading, empty, failed, or truncated results.

New schema and New file stay inline with one name field and Create / Cancel. Choose the parent resource before creating a schema. Canceling Domain creation does not delete a file or schema already created.

Secret Store

Choose Local File, Azure Key Vault, or Internal independently of the Data Platform. Local File needs no configuration in this form; secrets are supplied outside Studio, which never creates or edits that secret file.

Internal needs no external identity or vault configuration. Save the Domain, then open Secrets to manage its inventory. The Agent can discover active names without receiving their values. Switching to another store hides Secrets and retains Internal names and version history. See Secret Stores.

For Azure Key Vault, complete Authentication, then expand Vault. Only one detailed section stays open. User connection and service identity are independent choices. Reuse Data Platform connection appears only when the requirements are compatible. Separate service credentials appear only for Dedicated identity. In ambient mode, the form uses the host Azure identity and asks for Azure tenant ID, not delegated credentials. Select a listed vault or explicitly commit its supported Resource ID in the same dropdown; the resolved vault URL is read-only. Studio never displays saved secret values.

Repository in Basics

GitHub must already be connected under User Settings → Connections. Choose the account or organization and repository, then review the safe summary. The summary never includes secrets, tokens, or raw credential data.

If creation fails, your entries are preserved. Studio opens the first page with an identified error in Basics, Data Platform, Secret Store order and focuses the affected field. Every affected page gets an error marker; select a marked page to read its messages. Errors without a known page remain where you selected Create Domain. Correct the inputs and retry; editing alone does not clear the previous attempt's error markers.

How to configure a Domain

1. Select a Domain from the persistent list.
2. Open the relevant tab. Use General for identity, instructions, budget, and lifecycle actions. Use Resources for resource configuration and readiness.
3. Under Resources, expand Git Repository, Data Platform, or Secret Store. Expanding one closes the previous row.
4. Change the available fields and select Save changes.
5. Select the Domain-wide Reconcile action above the resource rows when you need fresh saved readiness results.

The Git repository and Data Platform resource identity are read-only after creation. The Git row shows organization and repository, but no default branch. Data Platform retains mutable service authentication and supported deployment-capacity selection. Secret Store can switch resource or type where your role permits; Studio does not copy secret values when it changes.

For Azure Key Vault, use Authentication and Vault just as during creation. The Key Vault dropdown shows the saved vault without rediscovery. Select a listed vault or enter its exact Resource ID in that dropdown; its URL is derived. There is no separate manual-entry mode. Use Save changes to apply an edit.

Fabric groups its resource details and capacity under Workspace. The collapsed row shows names and schema; expand it for the SQL endpoint and provider links. DuckDB shows Database and Schema name read-only, with no Save button when there is nothing editable.

Download a DuckDB file

Only users who can edit a DuckDB Local Domain can download its managed database file. In Resources, expand Data Platform, select Download file, then select Confirm lock and download. Select Download file again to save the browser download. Studio streams the existing managed database to the browser and keeps the Domain locked until the transfer finishes, is cancelled, or fails; select Cancel before downloading if you do not want to continue. This action is not shown for Fabric or MotherDuck Domains.

Ephemeral Workspace Capacity choices begin loading when Resources opens. While loading, the saved name or ID remains visible and disabled; a failure leaves it intact and offers Retry. This selects an Azure Fabric capacity, not a concurrent-workspace limit. Manage instance-wide concurrency limits under Org Settings → Capacity.

Opening Domains or expanding a resource does not validate anything. A dirty form must be saved before Reconcile. Changing Domains, tabs, resources, or leaving the workspace while a form is dirty asks whether to discard changes.

How to review Domain usage

1. Select a Domain and open Usage.
2. Use Date range to choose Last 7 days, Last 30 days, or Last 90 days.
3. Use View to switch between Overview and a listed LLM profile.
4. Select Refresh usage overview to refresh the selected Domain's filtered results from the shared usage scan.

The tab always stays fixed to the selected Domain. A Domain Owner can review a Domain they own; a Vibedata Owner can review any Domain. Domain Contributors and User Access Administrators do not receive usage access from those roles.

When the selected Domain has no recorded usage, the overview shows No usage found yet. The overview populates after an agent session writes token logs. Values are usage estimates, not a billing ledger.

How to read readiness

Resource rows show the last persisted result:

State	Meaning
Failed	At least one saved check failed. Open the resource for the diagnostic and recovery action.
Stale	Configuration changed after a successful check.
Pending	A check is incomplete, running, or required configuration is missing.
Ready	Every required check is ready and all other checks are not required.

Missing readiness information is never shown as Ready. Generic provisioning warnings appear once above the resource table. Repair personal provider connections under User Settings → Connections, return to Resources, save any configuration changes, and select the Domain-wide Reconcile action. GitHub App configuration remains under Org Settings → GitHub.

How to export or import Domain Intents

General chooses one transfer action from the number of non-deleted Intents:

• A Domain with one or more non-deleted Intents shows Lock and export this domain.
• A Domain with zero non-deleted Intents shows Import domain intents.

Retained deleted Intents do not make a Domain exportable.

For export, select Lock and export this domain, resolve any named active Intent edit leases, then confirm. During the run Studio shows Export in progress, locks Domain and Intent mutation controls, and offers Unlock domain to authorized users. Other open tabs update when the Domain locks or unlocks, including while Domains is backgrounded or closed.

Success shows Domain exported successfully and the bundle's relative location. If missing conversation history forced Studio to omit an Intent, it shows Domain exported with omissions and names every omission. An Intent with nothing to export may be listed without making the bundle incomplete. If a conversation cannot be read for another reason, export fails, names the Intent, and states that no bundle was produced. A failed run otherwise shows its stored failure message when available.

For import, select Import domain intents, enter the source Domain slug and export run ID, resolve any named active leases, and confirm. Studio locks the Domain while it reconciles each bundle Intent by slug. It does not overwrite an existing branch or database file. The terminal notice reports created, restored, unchanged, skipped, and warning counts; any skipped bundle Intent produces a warning rather than a plain success.

Select Unlock domain, then confirm, to request cancellation and restore editing. Export and import recovery remains available after reload, backend restart, or a change of authorized user.

How to archive or restore a Domain

Open General and select Archive when authorized. During Archiving, Studio prevents new work while it closes or archives Intents. If a running turn blocks the operation, Studio names the Intent and restores the prior Domain state.

Archived, locked, archiving, and deleting Domains are read-only. Select an archived Domain and choose Unarchive in General when authorized. A successful Unarchive returns the Domain to Pending while readiness is re-established.

Quick reference

Action	Where
Create a Domain	Global rail Domains → Add Domain
Edit identity or budget	Domain → General → Save changes
Configure a resource	Domain → Resources → resource row → Save changes
Refresh readiness	Domain → Resources → Reconcile
Review usage estimates	Domain → Usage
Export or import	Domain → General
Manage human access	Organization Settings → Users
Manage retained deleted Intents	Intent workspace