Claude Cowork and Kaji keep getting compared because they look similar at the surface. A person describes a goal, an agent plans the steps, executes across files and tools, and delivers finished work for review. The architectures underneath are opposites. Claude Cowork is Anthropic’s personal, goal-driven agent, running in isolated, temporary environments on Anthropic’s servers, or in a local virtual machine on the user’s workstation, included in every paid Claude plan. It is polished, fast to adopt, and genuinely strong at individual knowledge work. It does not run on the customer’s infrastructure, it does not carry a tamper-proof per-action audit log, and its access controls stop at the group level. Kaji is built for the other half: a governed enterprise AI runtime that runs inside the customer’s own VPC, on-prem, or air-gapped Kubernetes cluster. Every agent inherits the access of its operator, every prompt, tool call, and model response is captured in a tamper-proof log, and every model call flows through a unified gateway that enforces parameters, filters responses, and controls cost. One is a product an individual buys. The other is a platform an enterprise runs. For the CIO, COO, or CISO, the decision is not which product is better, but where each product is allowed to touch data. The pragmatic answer for most enterprises is not either/or. Run Cowork for individual research and drafting tasks, and run Kaji for agent work that touches customer data, internal systems, or a compliance boundary.
| Dimension | Claude Cowork | Kaji |
|---|---|---|
| What it fundamentally is | Personal, goal-driven AI agent for one user’s tasks | Governed enterprise AI runtime: autonomous agents inside the customer’s own infrastructure |
| Where it runs | Anthropic’s cloud in isolated temporary environments, or a local VM on the user’s workstation | Customer’s VPC, on-prem, or air-gapped Kubernetes (AWS, Azure, GCP, Oracle) |
| Deployment model | SaaS, self-serve, on by default in paid plans. No on-prem or VPC option | Deployed on customer-owned Kubernetes. Air-gapped available. Hosted Kaji Cloud on waitlist |
| Pricing | Included in all paid Claude plans: Pro $20/mo, Max $100 to $200/mo, Team $25/seat and Premium $125/seat per third-party pricing verification, Enterprise custom | No public pricing. Single enterprise tier, custom quote |
| RBAC | Group-level custom roles with SCIM on Enterprise. No workflow-level permissions yet | Native RBAC. Every agent inherits its operator’s access, credentials bound to users |
| Audit logs | Usage analytics dashboard and API, OpenTelemetry export. No per-action tamper-proof log | Tamper-proof log of every prompt, tool call, and model response, searchable in-platform |
| SSO/SCIM | Available on Enterprise plans, group-level | SSO, RBAC, and policy controls ship natively |
| Compliance certs | Anthropic: SOC 2 Type I and II, ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready with BAA on Enterprise | Reported as SOC 2 Type II certified. OWASP Top 10 LLM mitigation. Air-gapped deployment option |
| Data residency | Claude available with regional inference via Bedrock, Vertex, and Foundry. Cowork sessions run on Anthropic’s servers | Data never leaves the customer’s perimeter. Air-gapped keeps it physically disconnected from the internet |
| Connectors | MCP ecosystem. Zoom MCP connector at GA. Deeper ERP and CRM integrations still to build | 300+ data and AI components, 5,000+ data sources. AI Gateway as a single door for all model calls |
| Scheduled/unattended runs | Yes: “Close your laptop, Claude Cowork keeps going” | Yes: schedules, webhooks, and manual launch, with parallel sub-agents |
| Approval and oversight | Write tools treated differently. Human oversight recommended in high-stakes scenarios | Approval gates on risky actions before they execute |
| Best for | Individual knowledge work, quick cross-tool tasks, zero infra overhead | Regulated, data-touching, multi-team agent operations at enterprise scale |
Both products promise the same surface behavior: describe a goal, and an agent plans, works across files and tools, and delivers finished work for review. The two diverge on the questions that matter most to an enterprise: where the compute lives, whose credentials the agent holds, what gets logged, and who is accountable when the agent acts.
Claude Cowork is Anthropic’s autonomous agent for knowledge work. Per the product page, “The work behind your best work. Claude Cowork completes tasks you can steer from anywhere. Give it a goal, and it works across your files and tools. You come back to polished work for your review.” The unit of value is a single person’s work: their folders, their files, the tools that person has chosen to give Claude. The task runs end to end, and Claude shows each step, the files it opens, the tools it uses, and the choices it makes. Close the laptop and Cowork keeps going. Tasks can be scheduled for any cadence and run unattended.
The product ships across Claude Desktop (macOS, Windows, ChromeOS, Linux), the web in beta, mobile in beta, and Claude in Chrome, and it works with any paid Claude plan. The timeline is recent: a Max-only beta in January 2026, expanded to Pro within days, and general availability on April 9, 2026. At GA, Anthropic shipped six enterprise management features, per third-party analysis by sdd.sh: group-level RBAC with SCIM, group spend limits, usage analytics with a dashboard and API, OpenTelemetry support, per-tool connector controls, and a Zoom MCP connector.
The design intent is worth stating plainly. Cowork is a personal agent with an enterprise administration layer: the features control who can access the product, how much it can spend, and what the administrator can see. They do not change where the agent’s compute lives or the perimeter in which the agent’s work happens. That distinction drives most of this comparison.
Kaji is Shakudo’s governed enterprise AI runtime for real work. Per the product page, it “breaks goals into steps, uses your tools, spins up sub-agents, asks for approval before risky actions, and leaves a searchable audit trail.” Kaji was announced in early 2026, on February 10, 2026, alongside the Shakudo AI Gateway. It sits on the Shakudo Platform, a pre-integrated stack of 170+ AI, ML, and data components, and our agents work across 300+ data and AI components, connecting to 5,000+ data sources.
The platform lets teams build, automate, and run complex tasks in plain language, no code required: taking action on real systems, remembering decisions across sessions, automating scheduled work, delegating to parallel sub-agents, and browsing in a real browser. Users interact through KajiChat, the web chat surface where an agent plans, executes, and reports back.
The architectural fact that defines Kaji is where it runs. The platform runs entirely inside the customer’s VPC, on-prem, or air-gapped Kubernetes cluster. Agents execute in isolated sandboxes with inherited credentials, scoped permissions, and complete audit trails on every action. That single axis, in-perimeter execution, is what separates Kaji from SaaS agent products in this comparison.
The honest answer: a personal assistant with an enterprise administration layer, not an enterprise platform. The distinction matters because “enterprise features” and “enterprise architecture” are different things, and procurement teams routinely conflate them.
Where Cowork’s compute lives shows the design. On web and mobile, sessions run in Anthropic’s cloud: “Claude’s work runs in an isolated, temporary environment on Anthropic’s servers. The environment is created for that one session, can’t reach your home or company network, and is removed when the session ends” (Anthropic help center). Local sessions run on the user’s own computer, with the code in an isolated virtual machine. In neither case does the agent run on infrastructure the customer owns and operates.
The GA features, group RBAC, SCIM, spend limits, analytics, OpenTelemetry, and per-tool controls, are classic administration controls for a personal product deployed across an organization. They answer who may use it, how much it may cost, and what the administrator can see. They do not answer where it runs, whose credentials it holds, or whether its actions can be proven after the fact. Those are platform questions.
The IT community has already felt the friction. One sysadmin reported, in a snapshot of a public Reddit thread: “my company for now has blocked/disabled it… requires additional local device permissions we’re not comfortable providing, all our end users are non-administrators.” One practitioner noted: “Most companies centralize around one authorized LLM to simplify security, governance, and management requirements.” A second observer put it more simply: “Claude Cowork is just a friendly GUI for non-coders.” The governance debate at the organization level is not about user experience. It is about which LLM, and which deployment model, the organization is willing to standardize on.
So Cowork is an enterprise-governed personal agent. That is a real and valuable category. It is not, however, a platform that a regulated team can build shared, auditable, data-touching workflows on.
This is the question procurement and security teams actually ask. The answer has four parts.
RBAC and SSO. At GA, Cowork added group-level custom roles with SCIM provisioning on Enterprise plans, plus group spend limits, usage analytics, OpenTelemetry, and per-tool connector controls (sdd.sh). The permission model is group-level: a read-only group can query but not execute. Per sdd.sh, there is “no workflow-level permissions system yet,” which means an organization cannot say that only one named person can approve one specific agent’s write actions. For teams that need per-agent, per-action authorization tied to named individuals, the group model is a ceiling.
Audit. Usage analytics, delivered as a dashboard and an API, together with OpenTelemetry export, give administrators visibility into usage and spend. That is operational telemetry, not a tamper-proof, per-action log of every prompt, tool call, and model response, and not a compliance-grade record an auditor can walk through to establish what an agent did and who authorized it. Regulated environments are precisely the ones that will distinguish the two.
On-premise and data location. This is the hard limit. There is no on-prem, VPC, or private-cloud deployment option for Cowork. Everything runs on Anthropic’s infrastructure. Claude itself is available on AWS Bedrock, GCP Vertex, and Microsoft Foundry, with regional data residency options for the model layer, but Cowork does not support private cloud deployment. The local desktop session is not an escape hatch for data residency: it runs on the user’s workstation, in a virtual machine that requires BIOS virtualization enabled and, per one practitioner, local administrator privileges. For fleets of non-administrator workstations, that is exactly the friction the sysadmin quote in the previous section describes.
The Kaji side of the question. Kaji ships SSO, RBAC, and policy controls natively, with no bolt-on security stack. Tamper-proof logs capture every prompt, tool call, and model response, so an auditor can always know what happened and who did it. Every agent inherits its operator’s access: credentials bind to users and flow automatically to their agents, so an agent can never reach further than its operator can. And the deployment itself is inside the customer’s VPC, on-prem, or air-gapped, which is what makes the audit trail and the permission model enforceable at the infrastructure level rather than at the API level.
The answer depends on one structural fact and a set of verified guidance statements, and it is worth separating the two. The structural fact: every Cowork session runs on Anthropic’s infrastructure, or on the user’s own workstation in local mode. There is no VPC or on-prem option. If the compliance rule is that regulated data must never leave the customer’s environment, cloud-only execution is a blocker, and no certification from Anthropic changes that.
Anthropic’s own certifications are strong at the company level: SOC 2 Type I and Type II, ISO 27001:2022, ISO/IEC 42001:2023, and a HIPAA-ready configuration with a BAA available on Enterprise plans (Anthropic trust and certifications). Those certifications cover Anthropic’s systems and processes. They do not move the customer’s data path into the customer’s perimeter.
Anthropic’s published guidance for Cowork is specific, and it is worth quoting in full. From the “Use Claude Cowork safely” article: “Write tools inherently carry more risk as they can result in undesired actions. This is why Cowork treats write tools differently and human oversight is recommended in high stakes scenarios since Claude can sometimes make mistakes.” And: “Avoid granting access to local files with sensitive information, like financial documents. Be deliberate about which sites Claude works in…especially sites where you’re signed in or that handle money or personal information. Extend internet access only to sites you trust. Monitor Claude for suspicious actions that may indicate prompt injection.” That is guidance for keeping a personal agent safe, and it is honest guidance. It also describes the threat model: the agent operates outside the customer’s perimeter, and the customer’s controls are the instructions given to it.
For regulated workloads, the question flips from “how do I instruct the agent safely?” to “how do I architect the system so the agent cannot act unsafely?” That is the question Kaji is built to answer. We run entirely inside your VPC or on-prem environment, so your data, models, and agent workloads never leave the infrastructure you control. Air-gapped deployments keep the platform physically disconnected from the internet while delivering the full AI and data stack. Approval gates stop risky actions before they execute, and tamper-proof logs capture every prompt, tool call, and model response. Kaji is SOC 2 Type II certified, with OWASP Top 10 LLM mitigation and vulnerability scanning. For a bank, a hospital, or a defense contractor, that architecture, not Anthropic’s badges, is what the compliance review is looking for.
They look similar from the front: ask for a task, watch it plan, execute, and deliver. The architectures underneath are opposites, and the difference is where the agent is born.
Kaji is born inside the customer’s perimeter. The runtime runs entirely in the customer’s VPC, on-prem, or air-gapped Kubernetes cluster, on any cloud that runs Kubernetes, or on physical hardware. A parent agent plans the work and delegates to parallel sub-agents, called subkajis, that run simultaneously and scale to zero when finished. Approval gates stop risky actions before they execute. Every agent inherits its operator’s access: credentials bind to users and flow to their agents, with scoped permissions and isolated sandboxes. Every model call flows through the AI Gateway, the unified control plane: one endpoint for unified model access, granular parameter enforcement, response filtering that sanitizes sensitive fields before they leave the agent, and cost control per team and per model. Nothing bypasses the gateway.
Cowork is born in Anthropic’s cloud, or on the user’s laptop. It is a goal-driven personal agent with visible step-by-step execution that the user can steer, and unattended scheduled runs. Cloud sessions run in an isolated, temporary environment on Anthropic’s servers that cannot reach the company network. Files are provided to the environment, the work happens there, output is returned, and the environment is deleted. Local sessions run in a virtual machine on the user’s workstation, with the same perimeter implication in reverse: the agent is in the customer’s building, but on the user’s machine, with the user’s permissions, and no organization-level audit substrate underneath it.
Same surface behavior, opposite substrate. In Cowork, the customer hands the agent files and access on Anthropic’s side, and the organization’s controls are instructions and admin settings. In Kaji, the agent is born inside the customer’s perimeter, with the customer’s credentials, the customer’s logs, and the customer’s guardrails enforced at the infrastructure level. That is the difference between governing an agent and containing one.
Cowork has no separate fee. It is included in every paid Claude plan. Per Anthropic’s plan structure, that is Pro at $20 per month, Max at $100 to $200 per month, and Enterprise with a fixed seat fee plus separate usage charges. Per third-party pricing verification, Team Standard runs at $25 per seat and Team Premium at $125 per seat for teams of 2 to 150. Cowork is on by default, and organization owners can disable it. The cost model is per-seat, and it is predictable while usage is light and interactive.
Kaji has no public pricing. It is a single enterprise tier with a custom quote, and the quote covers the platform, the deployment on customer-owned infrastructure, and support. The cost scales with the infrastructure the customer already operates: its Kubernetes clusters, its cloud bill, its storage and networking. There is no seat count to grow, and no per-run fee to surprise an operations budget.
The token mechanics are where scale changes the picture. When agents run unattended on schedules, cost is dominated by model tokens, not by seats. A per-seat plan with usage-based overages, which is the Enterprise model Cowork sits under, grows with every agent, every run, every retry, and every verbose response. A platform where every model call passes through a single gateway that enforces parameters, routes between models, filters responses, and tracks cost per team puts that spend under direct control before it happens, not after the invoice arrives. At enterprise scale, the difference between “seats plus overages” and “infrastructure plus governed tokens” is where total cost of ownership actually diverges.
The honest trade-off: Kaji’s sales-led procurement, custom quote, and Kubernetes deployment requirement make it slower and heavier to start than a $20 per month self-serve checkout. Cowork is cheaper to start, and it is the right price for its job. Kaji’s economics make sense when the workload is large, the data is sensitive, and the alternatives are either a compliance review that fails or an operations budget that cannot absorb uncontrolled token spend.
Kaji is designed for governed, real work inside the customer’s own infrastructure: multi-step operations that touch internal systems, customer data, and compliance boundaries, and that need to run repeatedly, unattended, and auditable. The product page frames it as “Agentic AI That Plans, Delegates, and Delivers Inside Your Cloud,” and the product is positioned for regulated industries, with agents completing work end-to-end inside the customer’s VPC.
Kaji was announced in early 2026, on February 10, 2026, alongside the Shakudo AI Gateway, and it is built on the Shakudo platform, a pre-integrated stack of 170+ AI, ML, and data components, with our agents working across 300+ data and AI components and 5,000+ data sources. Named customers on shakudo.io include QuadReal, Loblaw Digital, CentralReach, Huntington Bank, and BWX Technologies. The product line is new and still maturing, which is worth stating plainly alongside the customer names.
The design targets the workloads that cannot be run on a SaaS agent: scheduled operational jobs, multi-system processes that require approvals, work on regulated data that must stay inside the perimeter, and parallel agent workloads where a parent agent delegates to sub-agents. Where an individual wants personal productivity, Cowork is the better fit. Where the organization needs agents that behave like employees, with credentials, permissions, and an audit trail, Kaji is the tool designed for exactly that. Explore Kaji, or see the Shakudo Platform for the full stack.
That does not make Cowork a weak product. It makes it a different category, and in that category it is strong. For individual knowledge work, Cowork wins on nearly every axis that matters to the individual:
The hybrid approach is the realistic end state for most large organizations. Run Cowork for individual work: analysts drafting reports, managers summarizing decks, developers prototyping. Run Kaji for critical operations: agents that touch customer data, run scheduled pipelines, coordinate across internal systems, and need a tamper-proof audit trail.
And the two can interoperate at the governance layer. The AI Gateway is a unified control plane for any agent, including Claude-based ones, so an organization can route third-party agent traffic through the same enforcement, filtering, and cost controls that cover its own agents. One is a product you buy. The other is a platform you run. Both can be true in the same enterprise at the same time.
No. Cowork has no on-prem, VPC, or private cloud deployment option. Web and mobile sessions run in isolated temporary environments on Anthropic’s servers, and local sessions run in a virtual machine on the user’s own workstation. Claude itself is available on AWS Bedrock, GCP Vertex, and Microsoft Foundry, but Cowork does not yet support private cloud deployment.
Kaji provides unified model access through the AI Gateway rather than being tied to a single model in its public documentation. The exact lineup of models available in a given deployment should be confirmed in a demo or proof of concept. What is documented: one gateway for all model calls, with parameter enforcement, response filtering, and cost control.
Yes. Cowork is included in every paid Claude plan, including Enterprise, with no separate fee. On Enterprise plans, administrators get group-level RBAC with SCIM, group spend limits, usage analytics, OpenTelemetry, and per-tool connector controls. Cowork is on by default, and organization owners can manually disable it.
Kaji captures every prompt, tool call, and model response in tamper-proof logs, stored inside the customer’s own infrastructure. The logs are searchable and tie each agent action to the operator whose credentials the agent inherited. An audit can answer what happened, what the agent did, and who authorized it.
Yes, and they target different jobs. An organization can run Cowork for individual knowledge work and Kaji for governed, data-touching operations. Because the AI Gateway is a unified control plane for any agent, including Claude-based ones, the same governance layer can cover both.
Cowork has no separate fee and is included in every paid Claude plan: Pro at $20 per month, Max at $100 to $200 per month, Team at $25 and $125 per seat per third-party pricing verification, and Enterprise custom with usage charges. Kaji has no public pricing. It is a single enterprise tier with a custom quote that covers the platform, deployment on customer infrastructure, and support.
SHAKUDO. The AI platform for enterprise. Get Started | Book a demo
