01
Workload architecture
A dedicated Workbench and workload data plane runs in your AWS account. AWS is the supported cloud path today; the broader platform architecture is portable by design.
← Deployment
BYOC · Calliope AI Workbench
Your AWS account. Your network. Your workload plane.
BYOC places Calliope AI Workbench, workload compute, and storage in your AWS account. Calliope Labs Inc does not receive or proxy prompts, code, model responses, or provider credentials. Hosted model requests go directly to the endpoints you approve.
Use the boundary your organization already operates.
Customer IAM, network policy, storage, encryption, logging, and region stay in the architecture. That gives security and platform teams familiar control points around the Workbench instead of asking them to approve a new black-box data plane.
BYOC does not make every workload zero egress. External model providers remain data destinations. Choose approved hosted endpoints where permitted and local or in-boundary models where inference must stay inside the network.
What changes when it is your cloud:
The Workbench experience stays consistent while the workload boundary and customer responsibilities change.
- Customer-owned compute · Workloads run in resources inside your AWS account
- Customer network policy · Use your VPC, subnets, routes, security groups, and private connectivity
- Region selection · Place the data plane in the AWS region approved for the workload
- Identity integration · Connect the Workbench to the approved SAML or OIDC identity provider
- Customer-held model credentials · Provider keys stay in the deployment environment
- Scoped support · Self-serve the baseline or add assisted onboarding and an engineering support relationship
Technical boundaries
02
Identity and operator access
Connect SAML 2.0 or OIDC and document any Calliope AI support access, telemetry, or management path required by the purchased operating scope.
03
Data and model destinations
Workspace data remains in customer resources. Hosted model requests leave the account directly for the approved provider. Local endpoints keep inference inside the approved boundary. Zentinelle AI may be added separately for agent-level policy and evidence.
