Identity, data boundaries, retention, network path, logging and billing settled with your security and procurement teams first, so the first real workload is a build decision rather than a governance argument.
Most enterprise AI programmes do not stall on capability. They stall in the six weeks between a successful pilot and a security review nobody prepared for.
Claude is available through Anthropic’s own API and through three cloud platforms. The choice is usually decided by where your data already sits and which commercial agreement you would rather draw down.
Claude deployed inside your Azure subscription, authenticated with Microsoft Entra ID and governed by Azure role-based access control.
Why it usually wins here: Usage appears on your Azure invoice as Claude Consumption Units and is eligible for Microsoft Azure Consumption Commitment drawdown. Global and US data zones are selectable, and zero data retention is available for sensitive work.
Claude called through Bedrock inside an existing AWS account, under IAM and the account’s existing guardrails.
Choose it when: the data the model needs already lives in AWS and moving it, or the egress bill for not moving it, is the deciding factor.
Claude served through Vertex AI within an existing Google Cloud project and its IAM model.
Choose it when: your analytics estate and service accounts are already on Google Cloud and a second cloud footprint is not worth opening.
Called straight from Anthropic, with enterprise administration and controls managed in the Claude console.
Choose it when: you want the newest capability on the day it ships and the workload does not carry data that forces a specific tenancy.
More than one of these can be right in the same organization: the API for experimentation, a cloud platform for anything touching regulated data. Where that is the case we set the boundary between them in writing, rather than leaving individual teams to interpret it on their own.
None of these are difficult. They are only expensive when they are answered after something is already in production.
Whose tenancy
Which cloud account or subscription the model is called from, and who administers it.
Whose identity
How users and service principals authenticate, and which groups carry which entitlements.
Where data may sit
Microsoft Foundry offers Global and US data zones. If your requirement is Canadian residency for a given workload, that is a design constraint to settle in week one, not a surprise at go-live.
What is retained
Whether prompts and completions are retained at all, and what your own logging keeps for evidence purposes.
What the model may reach
The specific systems, sites and record types in scope, expressed as permissions rather than as intent.
Who pays and how
Consumption billed to a cloud agreement, to Anthropic directly, or through AIM as your Cloud Solution Provider, and how it is attributed back to a cost centre.
What gets logged
Which prompts, retrievals, tool calls and approvals are recorded, where, and for how long.
Who can turn it off
The named person and the documented path for suspending an agent, and how long that takes in practice.
The output is an environment your security team has already reviewed, with a written service description for what happens in it.
Decision workshop
Half a day with the people who can actually decide: cloud platform owner, security, data protection, procurement. The output is a written position on the eight questions above, including the ones where the answer is that a requirement cannot be met.
Tenancy, identity and network
The subscription or account is configured, service identities are created and scoped, and the network path is agreed. Nothing here is AI-specific, which is why it should not be invented by the AI team.
Data boundary and logging
Which data zones are in use, what is retained by whom, and what your own logging keeps. If zero data retention is required for a class of work, it is configured and tested here rather than assumed.
Reference workload
One real, low-consequence workload built end to end in the new environment. It proves the plumbing, produces the first consumption data and gives your security reviewers something concrete to examine.
Security review and handover
The review pack goes to your reviewers, written for them rather than for us, and the environment is handed to whoever will own it with a service description naming what happens in it.
If your security function needs a formal assessment against a control framework, Arancia does that work and we sequence it here rather than after go-live.
A decision document your CIO, your security lead and your procurement team can sign, covering where Claude runs, what it may touch and what it will cost.
A two-hour session with the people who own the process, the data and the risk. You leave with a shortlist of candidate workloads, the constraints that rule some of them out, and an honest view of which one is worth a pilot.