LESSON 1 OF 5 · DEPLOYMENT ARCHITECTURE
One decision shapes the entire engagement
By the end of this lesson you can recommend a deployment path for any client profile and defend it on billing, auth, compliance, and capability grounds.
Why this decision is hard to reverse
The path sets the rails before anyone writes a prompt
Where the client's Claude Code traffic runs determines who bills them, how users authenticate, where usage data lands, and which features exist at all.
- Procurement signs against the billing route
- Security reviews the auth model
- Finance builds chargeback on the cost-tracking surface
Reversing the path after rollout means re-running all three workstreams, which is why on a standard 30-day activation this recommendation lands in pre-kickoff, the two weeks before Day 0, alongside the security questionnaire and org-level setup, not in a mid-engagement change request. Treat it the way you'd treat a platform selection in any modernization engagement: a one-way door unless someone pays to walk back through it.
Working rule
The client's existing cloud commitments and compliance posture pick the path. Your job is to surface them before the client picks by default.
The four paths
Same Claude Code, four different rails
The CLI is identical on every path. What changes is everything around it.
01
Claude for Enterprise (direct)
Anthropic's recommended default. Seat-based contract, SSO and domain capture, role-based permissions, managed policy settings, compliance API. The only path that bundles Claude on the web and the only path eligible for zero data retention. Auth is Claude.ai SSO; cost tracking lives in the usage dashboard.
02
Amazon Bedrock
Model traffic stays inside the client's AWS account. PAYG billing through AWS, so spend burns down existing AWS commitments. Auth via IAM or Bedrock API keys, audit via CloudTrail, cost tracking in Cost Explorer, content filtering via Bedrock Guardrails. The client owns model enablement per account and region.
03
Google Vertex AI
GCP-native equivalent. Billing through GCP, auth via GCP credentials and Application Default Credentials, IAM roles, Cloud Audit Logs. Model access is requested per project through Model Garden and can take 24 to 48 hours to approve, which matters for activation timelines. Supports global, multi-region, and regional endpoints.
04
Microsoft Foundry
Azure-native path. Billing through Azure, auth via API key or Microsoft Entra ID, RBAC policies, Azure Monitor. The client provisions Claude model deployments in the Foundry portal. One nuance to know cold: Foundry requests route to Anthropic-operated infrastructure, unlike Bedrock and Vertex. That changes the data residency conversation, and Lesson 3.5 covers how.
The decision drivers
Four questions, asked in this order
Work through these in discovery. The client's answers do the narrowing.
1
Where do cloud commitments sit?
A committed-spend agreement the client needs to burn down, an AWS EDP (Enterprise Discount Program), GCP CUD (Committed Use Discount), or Azure MACC (Microsoft Azure Consumption Commitment), is the single strongest pull toward the matching cloud path. Spend that counts against the commitment is money the client considers already spent. Ask procurement, not just IT.
2
How does procurement want to buy?
Seat-based subscription through a new Anthropic contract, or PAYG through a cloud marketplace vendor they already have on paper? Many enterprises can approve marketplace spend in days and a new vendor in months. This decides timelines as much as architecture.
3
What does the compliance posture demand?
If the client requires zero data retention, that is Enterprise direct only. If they require traffic to stay inside their own cloud tenancy and regions, that points to Bedrock or Vertex. Get the security questionnaire early; Lesson 3.5 gives you the answers it will ask for.
4
Who manages users and budgets?
Enterprise direct gives admins seat management, managed policy settings, and a usage dashboard out of the box. On the cloud paths the client builds the equivalent from IAM plus cloud cost tooling, or adds an LLM gateway for central auth and budgets. That gateway pattern is Lesson 3.4.
The trade-off to name out loud
Cloud-native control, or the full product
Every path recommendation is a trade. Saying the trade explicitly is what separates a recommendation from a preference.
Cloud provider paths
The client's perimeter, the client's tooling
Traffic and billing inside infrastructure the client already governs. IAM they already audit, cost tooling finance already uses, commitments procurement already signed. The cost: no bundled Claude on the web, no ZDR, and a handful of capability gaps you will flag in Lesson 3.2. Two consequences hit the activation directly:
- Own model version pinning: unpinned aliases resolve to defaults that can lag new releases or break users when a model isn't enabled in their account yet; pin versions in managed settings before rollout
- Build the usage dashboard: cost reporting gets assembled from Cost Explorer, GCP Billing, or Azure Cost Management, or centralized through the gateway pattern in Lesson 3.4
Claude for Enterprise direct
The full surface, managed by Anthropic
One subscription covers Claude Code and Claude on the web, with SSO, seat management, managed settings, compliance API, and ZDR eligibility. The cost: a new vendor relationship, seat-based pricing rather than committed-spend burn-down, and model traffic to Anthropic's platform rather than the client's own tenancy.
From decision to Day -14
The recommendation writes your pre-kickoff checklist
On a 30-day activation, pre-kickoff runs from Day -14 to Day 0. Each path puts different blockers on that list, and some have lead times you cannot compress.
Enterprise direct
Identity is the long pole
- Configure SSO and domain capture with the client's IdP team
- Map seat list and role assignments
- Apply managed policy settings
- Submit ZDR enablement request to the Anthropic account team if required; it is confirmed per organization
Amazon Bedrock
Account plumbing, mostly same-day
- Submit use-case form per AWS account (access is immediate)
- Create IAM policy for model invocation and inference profiles
- Enable Claude models in target regions
- Pin model IDs in shared settings before anyone installs
Google Vertex AI
File the access request on Day 1
- Enable Vertex AI API on the project
- Request Claude access in Model Garden (approval can take 24 to 48 hours)
- Confirm quota in the target region
- Pin model IDs in shared settings
Microsoft Foundry
Provision deployments, fix the versions
- Provision Foundry resource
- Create Claude model deployments with fixed versions rather than auto-update
- Agree Entra ID roles or API key handling with the identity team
- Pin deployment names in settings
Scenario · Make the call
Meridian Capital wants a recommendation by Friday
A financial services client, 800 developers, is activating Claude Code. You lead the deployment workstream. Four decisions, eight points. Choices have consequences.
Simulation
Meridian Capital · Deployment workstream
You're in the room now. Click a card to commit to a choice. Choices lock, consequences land, and the credibility meter travels with you. Green is a strong call, orange is defensible, grey costs you the room.
Credibility · 0 / 8
1
Decision 1 of 4 · Discovery call
You have 30 minutes with the client's platform lead and a procurement manager. What do you pin down first?
Choose your move
A
Seat count and rollout phasing
How many of the 800 developers need access in wave one, and on what timeline.
Select
B
Cloud commitments and buying route
Whether an EDP, CUD, or MACC exists, and whether procurement prefers marketplace spend or a new vendor contract.
Select
C
IDE standards and repo structure
Which editors the teams use and how their monorepo is laid out, so setup guidance is ready.
Select
2
Decision 2 of 4 · The recommendation
Procurement confirms a three-year AWS EDP with significant unburned commitment, and the CFO wants AI spend counted against it. The security review is still pending. What goes in your recommendation draft?
Choose your move
A
Bedrock, conditional on the security review
EDP burn-down plus AWS-native IAM and CloudTrail fit their stated priorities. Flag that the pending review could still change the call.
Select
B
Enterprise direct
Strongest admin controls, bundled web access, and ZDR eligibility. Recommend it as the premium option despite the EDP.
Select
C
Microsoft Foundry
Their identity stack is Entra ID, so the Azure path gives the cleanest authentication story.
Select
3
Decision 3 of 4 · The CISO pushes back
In the review meeting the CISO asks: "Can we get zero data retention on Bedrock?" The room looks at you.
Choose your move
A
"Yes, ZDR applies on every path"
Reassure the room that Anthropic's zero data retention covers Claude Code wherever it runs.
Select
B
"No. On Bedrock, retention is governed by AWS"
Anthropic ZDR is an Enterprise-direct capability. On Bedrock, inference runs in their AWS account, so retention and encryption follow AWS policies they already control.
Select
C
"Let me take that away and confirm"
Park the question and follow up with the Anthropic account team after the meeting.
Select
4
Decision 4 of 4 · The CIO's last question
The CIO is ready to sign off on Bedrock but asks: "What are we giving up versus going direct?"
Choose your move
A
Keep it commercial
Explain the billing difference: PAYG burn-down instead of seats, and a usage dashboard they'll have to build from AWS tooling.
Select
B
"Functionally nothing"
The CLI is the same binary on every path, so the developer experience is identical. Keep the momentum toward sign-off.
Select
C
Name the parity gaps
No bundled Claude on the web, no Anthropic ZDR, WebSearch unavailable, and the client owns model version pinning. Offer a one-page gap memo before sign-off.
Select
Engagement debrief
0 / 8
The path you took
Course artifact · Lesson 1 contribution
Deployment Decision Doc
By the end of this course you'll have a Deployment Decision Doc for a sample client: the path recommendation plus the auth, network, gateway, and compliance posture that defends it. This lesson contributes the client profile and path recommendation.
1
Open a new doc. Define a sample client: industry, developer count, primary cloud, and one committed-spend agreement (EDP, CUD, or MACC).
2
Answer the four decision drivers for that client in one sentence each: commitments, buying route, compliance posture, admin ownership.
3
Write the recommendation: one path, two sentences of rationale, and the single condition that would change your call.
4
List the pre-kickoff blockers your path creates, each with an owner and a lead time, so the doc drops straight into the Day -14 checklist of an activation plan.