Pilot a branch AI gateway.

Choose a team and a few everyday tasks.

Pick a small group in one office. For Claude Cowork, try preparing a report from fictional office documents or comparing sample files. For Claude Code, try explaining or updating a small test project. Staff keep using familiar tools while IT manages model access through the gateway.

Agree on the tasks, approved Claude models, sensitive fields to protect, spending limits, and acceptable response times. Start with fictional data and a small test budget. For Cowork, give access only to the sample folders needed for the pilot.

This example uses Claude models through an Anthropic provider connection. Other deployments can use supported cloud providers or configured local model endpoints where the chosen app supports them. The AI governance brief explains the request path and scope.

Choose interfaces and a runtime placement.

List the site's WAN and LAN connections, optical-interface requirements, cellular needs, rack space, power, cooling, and remote access. Compare the Small / Portable office, Medium office, and Large office configurations against those requirements.

The Small / Portable office model provides four 2.5GbE WAN ports and two 2.5GbE LAN ports, with optional up to two built-in 5G modems. Rackmount configurations provide other interface and power options. Port rates are interface specifications; workload capacity requires a measured pilot on the selected hardware.

Confirm integrated or companion AI runtime placement, compatible software and licensing, and the branch gateway's readiness. A companion runtime is a separate branch device; integrated placement hosts the runtime on the SD-WAN appliance. Include local-model hosting and API compatibility in the plan when local models are selected.

Compare privacy configurations using the inspection study's measured results and test conditions.

Give staff controlled access through virtual keys.

1. IT opens the Portal's AI Gateway page and adds Anthropic under Provider Connections, keeping the upstream provider credential under administrative control.
2. Choose the Claude models the team may use. Include any additional models the apps need for background tasks.
3. Create a Policy Bundle with the privacy mode, sensitive fields, detectors, and inspection failure behavior to test.
4. Under Client Keys, create a separate virtual key for each pilot participant. Attach the provider connection, allowed models, branch, policy bundle, budget, and request limits.
5. Copy each token when shown and deliver it through the team's approved credential process. Staff use these virtual keys in their configured Claude apps.
6. Check the Portal's deployment status and confirm that the branch gateway is ready before staff start their tasks.

Separate keys let IT review usage and revoke access for one participant. A shared team key is also possible, but its usage and limits are combined and its records do not identify individual staff. Each virtual key belongs to one provider connection; the same policy bundle can be attached to several keys.

Set up Claude Cowork and Claude Code.

IT supplies the branch gateway's HTTPS address, each participant's virtual key, and the approved model choices. The address must be reachable from the pilot devices, with a certificate they trust.

Claude Cowork: office tasks in Claude Desktop

1. Use Claude Desktop's third-party inference setup. IT can configure a pilot device or distribute the settings to managed devices.
2. Open Help → Troubleshooting → Enable Developer Mode, then Developer → Configure Third-Party Inference. Choose Gateway as the inference provider.
3. Enter the branch address in Gateway base URL and the participant's virtual key in Gateway API key. Choose Static API key and Bearer authentication.
4. Select Apply Changes to relaunch with these settings. Open Cowork, select an approved Claude model, and try the sample office task.

Anthropic documents this gateway deployment mode for Cowork and Code in Claude Desktop on third-party inference. IT can follow its desktop gateway setup guide for device configuration.

Claude Code: development tasks

Claude Code in the configured desktop app uses its third-party inference settings. For the command-line or editor version, IT configures the gateway address, virtual key as a bearer token, and approved Claude model using Anthropic's Claude Code gateway instructions. Staff then open their test project and try a small development task.

Before expanding, confirm both apps' requests appear under the intended virtual keys. Test streaming replies, tool actions, and follow-up turns against the selected gateway release and model.

The same approach can serve other apps, including internal tools, that support a custom gateway address and API-key authentication. Match their API format and required features to the gateway's compatibility; an API-key field alone does not establish compatibility.

Test the team's normal tasks and privacy rules.

Have IT also check a revoked virtual key, an unapproved model, a key assigned to another branch, and an exhausted test budget. Record what staff see in the app and what the gateway reports. Confirm denied requests do not trigger an unintended provider call.

The gateway's audit records show decision and usage metadata. They exclude request and response bodies, so IT needs approved test instrumentation with fictional inputs to verify the actual values forwarded to the provider.

Fixture choice matters. The synthetic email-domain lab study shows how changing a test-data detail changed the detection count. Validate both fields that must be detected and inputs that should remain unchanged.

Approve a measured scope, then expand.

Record the hardware, gateway release, Claude app versions, approved models, keys, policies, and test results. Check whether the team can finish its tasks with acceptable response times. Review provider charges and data handling alongside the gateway's settings.

Review app permissions, connected tools, browser-based AI use, and devices away from the office. The gateway governs model requests routed through it; file access, tool actions, and other traffic need their own controls. Confirm the governed path before enabling branch network enforcement.

Assign owners for key rotation and revocation, model changes, budget alerts, audit retention, upgrades, and support escalation. Agree on a recovery or rollback procedure before expanding to more sites. For multi-WAN pilots, include the WAN failure and restoration checks.

MSPs and other partners can use this checklist to plan customer deployments. Contact the partner team to get started.