Deployment Tiers

What changes between tiers:

• Identity scope — direct SSO → per-tier role mapping.

• Operations model — self-service per workspace → fleet-managed by a dedicated platform team.

• Audit centralization — per-workspace → centralized OCSF / SIEM.

• Cost telemetry and budget controls — per-workspace meter → centralized FinOps integration with budget gates.

The pattern is the same across all five tiers; the difference is operational scale.

Inference is routed by default — to an approved internal or external model endpoint — and is independent of the tier’s compute shape; GPU acceleration and inference are separate choices. Agentic coding with frontier models runs on routed inference at any tier, including CPU VM. On-device GPU inference is the exception: smaller models that fit the device, or sensitive / sovereign context where data cannot leave the host. The GPU tiers provide acceleration for tools and local model options, not a requirement for agentic coding.

Table 8: Deployment Tiers

Tier	Target Use	Typical Shape	Notes
CPU VM	Starter POC; agentic coding, documentation, and low-intensity workflows on routed inference	Managed VM	Good first step for proving access, identity, connectors and audit; sufficient for most agentic coding
GPU VM or workstation	GPU-accelerated tools and test loops; local experimentation with models that fit a single GPU (frontier-model coding still uses routed inference)	Managed VM or workstation with GPU	Good for teams standardizing agent workflows that need local acceleration; inference routed by default
Deskside accelerated workstation	Power users and researchers; local inference of models that fit the device; sensitive / sovereign context where data cannot leave	DGX Spark, DGX Station, RTX PRO workstation	Fits long-running agent loops and local model options
Team shared system	Multiple users, each in a separate per-user environment on shared hardware; larger models, shared datasets, heavier test workloads	Shared DGX, HGX, or RTX PRO Server	Shared capacity hosting separate per-user VMs / micro-VMs — not a shared workspace; requires stronger scheduling, tenancy and data controls
Platform fleet	Broad enterprise rollout	Managed fleet with package channels, policy distribution, telemetry, SIEM	Requires signed releases, rollback, support ownership and incident process

Device sanitization between users. GPUs and other stateful devices (VRAM, caches, scratch storage, NVMe local SSD) must be wiped between users — per-workspace reprovisioning is the basic mechanism.