01
Architecture
Private connectivity links the access layer to the customer AWS account. Workbench compute and primary storage run in the customer VPC while users work through a browser session.
← Deployment
VPC gateway
Move the session, not the working copy.
Users reach Calliope AI Workbench through the browser while notebooks, agents, and queries execute in the customer VPC. The gateway reduces endpoint copies without pretending that screen, model, support, or management traffic does not exist.
Remote access with the workload kept close to its data.
Field teams, contractors, and distributed engineers may need approved tools without receiving local copies of sensitive code or datasets.
A VPC gateway streams the user interface to the browser while compute and primary storage remain in the customer environment. Authentication, display traffic, model requests, downloads, clipboard behavior, and operator access must still be defined by policy.
Where the gateway helps:
Use it when people can be remote but the working environment must remain centralized.
- Remote engineering · give users a browser session instead of a local repository copy
- Contractor access · scope identity, applications, network destinations, clipboard, and download permissions
- Client environments · keep client work inside the environment approved for that engagement
- Regional workloads · place compute and storage in the region selected for the data
- Vendor operations · grant time-bound access to specific systems and retain workspace access records
Data flow and control points
02
Traffic
Browser display and input traffic cross the gateway. Approved hosted model requests travel directly from the deployment to the selected provider. Use a local or in-boundary model when model traffic cannot leave the VPC.
03
Security controls
Customer IAM and network policy control the environment. Workbench provides base access records. Add Zentinelle AI separately when the design requires agent-level policy decisions and evidence.
