We don't currently expose the `domain` a request comes from in permissions, but we'd be happy to add that in. I've opened up a ticket here [1].

[1] https://github.com/instantdb/instant/issues/18