Spokes.wiki Search About
Tech Article source ↗ source url updated Sat Jul 04 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

Claude apps gateway for Google Cloud

A self-hosted governance gateway for fleet deployments of Claude Code, co-announced by Anthropic (Roy Arsan) and Google Cloud (Ivan Nardini), 4 July 2026. It is a stateless proxy an enterprise runs in its own GCP project that sits between developers’ Claude Code clients and Google Cloud’s Vertex AI, and centralizes the operational controls a fleet needs: identity, policy, spend, telemetry, and routing claude-apps-gateway.

Tier T3 — first-party vendor announcement (blog). It is technically substantive (architecture, gateway.yaml, deploy steps) and points to standalone first-party docs (code.claude.com/docs/…/claude-apps-gateway-on-gcp, which would be T1); recorded as T3 because the ingested source is the announcement, not the reference docs or an independent test.

What it does

The gateway replaces per-developer cloud credentials with one managed, auditable layer. Five controls:

  • Identity (no keys on laptops). Device-code login redirects to the org’s IdP (Google Workspace or any OIDC provider — Okta, Entra ID); the gateway issues short-lived session tokens. Onboarding = add to an IdP group; offboarding = remove, and the next session fails.
  • Policy (RBAC). Rules live in gateway.yaml, checked server-side on every /v1/messages call — group-scoped restrictions on which models/tools a user may reach; changes propagate fleet-wide within ~1 hour.
  • Spend caps. Per-user / per-group / org-wide daily/weekly/monthly limits, metered in real time against a Cloud SQL ledger; a request over the cap returns HTTP 429.
  • Telemetry & attribution. Every request is tagged with the verified email/groups from the session JWT (server-verified, not client-set, so it can’t be spoofed) and shipped via OTLP/HTTP to Cloud Monitoring / Grafana / Datadog.
  • Routing & failover. A single Cloud Run service identity makes all outbound calls; regional failover via multiple upstreams:; all inference stays inside the customer’s GCP project/VPC.

Architecture: a stateless container on Cloud Run (or GKE) + Cloud SQL Postgres (session state and spend ledger) + Secret Manager, routing to Vertex AI. Client → gateway auth is device-code; gateway → Vertex auth is the Cloud Run service account (no key files).

Why it’s here

The gateway is the first-party, Claude-Code-specific instance of the spoke’s “vendor runtime-governance layer” thread. openclaw-hermes-control-layer named the pattern — the contest has moved past model selection to who owns the runtime, the governance, and the memory — and NVIDIA NemoClaw and Microsoft Scout are the third-party shapes: wrap someone else’s harness (openclaw/hermes-agent) in sandboxing + identity + managed inference. The Claude apps gateway is the shape those foreshadowed but from the harness vendor itself: Anthropic governing its own agent (Claude Code) with the same anatomy — identity + RBAC policy + spend + telemetry + routed inference. Its “route all inference through one service identity, developers never hold keys, RBAC decides which models they reach” is the same control-plane-owns-which-model-you-call move nemoclaw makes with OpenShell, here delivered as a turnkey GCP deployment.

Two existing threads it sharpens:

  • The cost-structure tension gets an operational answer. anthropic-agent-sdk-billing-pause exposed that running the harness hard breaks flat-subscription economics; the gateway’s per-user spend caps + real-time metering are the enterprise-fleet lever for exactly that — cap and attribute runaway usage rather than repricing it. Governance and cost control are the same surface here.
  • It’s the governance twin of agent-starter-pack. Both are Google-Cloud, Cloud-Run-based Claude/agent operations tooling — agent-starter-pack is deploy an agent to production; this is govern a fleet of developers using one. Together they fill the deploy→operate→govern end of the harness stack on the same substrate.

Cross-spoke

  • ../platform-ops-wiki — the gateway is a self-hosted, observable (OTLP → Cloud Monitoring) Cloud Run service with failover and SLO-shaped spend guards; the operating it as production infra is that spoke’s lens (the same verification-runtime seam). Here the subject is the agent-governance product, not the SRE practice.
  • ../llm-providers-wiki / ../cloud-wiki — it routes to Vertex AI (Google Cloud as a Claude reseller / host); the model-market and cloud-hosting facets are those spokes’ — noted, not duplicated.

anthropic · agent-starter-pack · openclaw-hermes-control-layer · nemoclaw · microsoft-scout · anthropic-agent-sdk-billing-pause · agent-guardrails · claude-managed-agents · synthesis

Related pages

Links to

Linked from