Claude Models on Google Cloud, Anthropic Managed: IAM Roles, Workspace IDs, How It Differs From Google Managed and a Migration Checklist

What launched

The Claude Platform release notes for 22 October 2026 announce Claude Models on Google Cloud (Anthropic managed): the Claude API, operated by Anthropic, reached through your Google Cloud project, with Google Cloud IAM controlling access and Google Cloud Marketplace handling billing. Fast mode for Claude Opus 5.5 is available on it from launch. It sits beside the existing Google-managed offering, in which Google operates Claude models inside its Agent Platform, so a team on Google Cloud now has two ways to call Claude, and they differ in more than branding.

The two Google Cloud offerings side by side

The documentation adds that both use Google Cloud credentials, including Application Default Credentials, but access is granted separately to each through its own roles. Claude 4.6 and later models use their Claude API IDs on both; for earlier models the Google-managed offering puts an @ before the snapshot date. If you call api.anthropic.com with an API key, you use neither.

How a request changes

The Anthropic-managed offering serves the Claude API under a project-scoped base URL: https://claude.googleapis.com/v1/projects/{project}/locations/global/workspaces/{workspace}/invoke, with organisation-level routes under a claudeOrganization path instead of a workspace. The documentation lists exactly three differences from a Claude API request: that base URL, an Authorization: Bearer header carrying a Google access token instead of an x-api-key header, and the workspace in the URL instead of an anthropic-workspace-id header. The anthropic-version and anthropic-beta headers, the body, streaming and the response stay the same.

Python following the documented client; the client is labelled beta and needs a project with the subscription and roles in place.

# pip install -U "anthropic[google_cloud]"
# export ANTHROPIC_GOOGLE_CLOUD_PROJECT=my-project-id
# export ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID=wrkspc_...
from anthropic import AnthropicGoogleCloud

client = AnthropicGoogleCloud()        # token from Application Default Credentials
message = client.messages.create(
    model="claude-opus-5-5",
    max_tokens=1024,
    messages=[{"role": "user", "content": "Summarise this incident timeline."}],
)
print(message.content[0].text)

The client resolves the project from ANTHROPIC_GOOGLE_CLOUD_PROJECT, then GOOGLE_CLOUD_PROJECT, then the project Application Default Credentials report, and raises an error if no workspace ID is set unless you set a base URL. The location stays global; the documentation separates it from where inference runs and points to inference_geo on each request for US-only inference. The client ignores ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL, which is a useful property in a mixed environment but a surprise if you expected an existing variable to redirect it.

Access, workspaces and one sharp edge

Three predefined roles are granted on the project. claude.viewer can get and list workspace resources. claude.user adds creating and changing them, which includes sending messages, counting tokens, and managing batches, files, skills and Claude Managed Agents resources. claude.admin adds organisation-level routes and is the only role that can open the Claude Console from the Google Cloud console; email sign-in to that organisation is not possible. Because roles are granted on the project, a role applies to every workspace in it, so the documentation recommends a separate project, and therefore a separate Anthropic organisation, per team that needs separate access.

The sharp edge is in Managed Agents. Access is checked when a session or a scheduled deployment is created, not while it runs. Revoking a person's Google Cloud access does not stop the sessions they started or the deployments they scheduled; the documentation says to interrupt such sessions and pause or archive such deployments, and to review them whenever a user is removed or a service account is rotated. Put that step in your offboarding runbook.

What is supported, and what is not

Billing goes through Marketplace in Claude Consumption Units of one US cent, with usage counting toward a Google Cloud spend commitment like other Marketplace purchases, and no separate Anthropic invoice. Anthropic is the data processor, the Claude API retention policy applies, and Zero Data Retention is available on request but does not carry over from another Anthropic organisation. Rate limits are Anthropic's, not Google's, so quota requests go to your Anthropic account team rather than through Google Cloud quota pages. Context window sizes match the Claude API, and Cloud Audit Logs record the calls on the Google side, which gives security teams one familiar place to look.

Migration checklist

1. Decide which offering you need: Anthropic managed keeps the Claude API surface and Anthropic rate limits; Google managed keeps everything inside Agent Platform.
2. Subscribe in Marketplace, enable claude.googleapis.com and anthropic-managed-claude.cloudpartnerservices.goog on each calling project, and complete the organisation setup.
3. Grant roles/claude.user to service accounts and roles/claude.admin only to the people who administer the organisation. Do not remove the service agent role grants that enabling the API creates.
4. Record the workspace ID per environment and set it through ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID, never as an anthropic-workspace-id header.
5. Replace API-key clients with AnthropicGoogleCloud, and remove API-key and base-URL variables from those deployments so nothing silently routes elsewhere.
6. If you use the ant CLI, unset API keys, profiles, federation variables and ANTHROPIC_WORKSPACE_ID first; the documentation lists each as taking precedence or adding a header that these requests must not carry.
7. Re-check model availability: a model not enabled for the new organisation returns an error naming its inference configuration.

Verification and limits of this guide

Nothing here was run against a live project: the guide is based on the release note and documentation read on 26 October 2026, and the client is labelled beta. Before switching production traffic, send one request per model you use, confirm the Usage page in the Claude Console shows it, which the documentation says can take a few minutes, and confirm a caller without roles/claude.user gets a 403 from the Google gateway.

Practice and related reading

Further reading:

• Moving to Anthropic API version 2026-10-21
• Pacing an agent fleet from rate-limit headers
• Google Cloud IAM

Sources and scope

Checked against these sources on 26 October 2026. Event: Claude Platform release notes, 22 October 2026; recheck it before acting. Examples and figures are illustrative, not measurements.

• Claude Platform release notes (22 October 2026)
• Claude documentation: Claude Models on Google Cloud (the two offerings compared)
• Claude documentation: Claude Models on Google Cloud (Anthropic managed)