A data-backed comparison for selecting Team Standard, Team Premium or usage-based Enterprise. All implementation, identity and governance detail is shown in full.
Measured from timestamped Claude transcript usage joined to the extension’s five-hour and seven-day quota timeline. Values are API-list-price compute delivered before Team usage credits.
| Model | Metric | Conservative | Central | Aggressive | Basis |
|---|---|---|---|---|---|
| Sonnet 5 | API value in one fully used 5-hour window | $108 | $126 | $194 | Three high-signal Sonnet-led windows moved 12%–40% of the five-hour meter and 2%–4% of the weekly meter. The aggressive week includes later cache-heavy one-point weekly samples. |
| Included API value per week | $950 | $1.08k | $1.56k | ||
| Included API value per 4.33-week month | $4.11k | $4.69k | $6.77k | ||
| Team advantage per month | $4.03k | $4.61k | $6.69k | ||
| Opus 5 | API value in one fully used 5-hour window | $78 | $125 | $194 | Inferred envelope between measured full-limit Fable and Sonnet efficiency; central value is the geometric midpoint. Existing Opus traffic was advisor/subagent work, not a main-Opus quota interval. |
| Included API value per week | $514 | $896 | $1.56k | ||
| Included API value per 4.33-week month | $2.23k | $3.88k | $6.77k | ||
| Team advantage per month | $2.15k | $3.80k | $6.69k | ||
| Fable 5.1 | API value in one fully used 5-hour window | $60 | $66 | $78 | Three Fable-only windows moved 34%–110% of the five-hour meter and 4%–14% of the weekly meter. Weekly value is normalized to Fable’s 50% included ceiling, not 100%. |
| Included API value per week | $257 | $277 | $307 | ||
| Included API value per 4.33-week month | $1.11k | $1.20k | $1.33k | ||
| Team advantage per month | $1.03k | $1.12k | $1.25k |
“Team advantage” = extended-month included API value − the $80 Premium price difference versus a $20 usage-based Enterprise seat. It assumes zero Team credits and full use of the measured capacity.
| Model / UTC window | 5-hour movement | Weekly movement | Measured API value | Normalized 5-hour value | Normalized included week |
|---|---|---|---|---|---|
| Fable · Sep 10 19:08–23:49 | 92% | 11% | $60.89 | $66 | $277 at 50% |
| Fable · Sep 11 02:47–04:49 | 34% | 4% | $20.56 | $60 | $257 at 50% |
| Fable · Sep 11 04:51–08:13 | 110% | 14% | $85.97 | $78 | $307 at 50% |
| Sonnet-led · Sep 13 02:20–06:06 | 40% | 4% | $43.31 | $108 | $1,083 |
| Sonnet-led · Sep 13 07:36–10:07 | 15% | 2% | $18.95 | $126 | $948 |
| Sonnet-led · Sep 13 18:22–22:13 | 12% | 2% | $23.32 | $194 | $1,166 |
Fable rows are model-only. Sonnet rows exclude the API value of Fable advisor calls but conservatively leave their quota movement in the denominator; that biases Sonnet capacity downward. Raw transcript events were deduplicated by session, message and request before joining to quota timestamps.
Premium has a rolling five-hour session limit and a fixed weekly limit. Weekly capacity does not let a user bypass a depleted five-hour window: work pauses until that window resets or continues on paid credits. The measured workload produced roughly 6–10 full Sonnet windows per week and about 4 Fable windows before Fable reaches its 50% weekly ceiling.
Limits are per member. Idle capacity cannot be transferred to another engineer, and switching or rotating a seat is not documented to reset quota. Sizing therefore has to use user-level percentiles, not total organization tokens divided by seat count.
Premium includes Fable only through 50% of the regular weekly limit. An “all-Fable week” is not flat-rate: after the ceiling, the user must switch models or pay API-rate usage credits. Standard seats pay credits for Fable from the first token.
Multiplying by 4.33 assumes the user consumes the same included capacity every week. Vacation, lighter work and unused windows lower realized value; enabled credits and limit changes lower net savings.
Source: timestamped raw Claude transcript usage, deduplicated by session/message/request and priced at
current API list rates; ccusage is the aggregation cross-check. Dominant conversation from
Sep 9 18:59 to Sep 14 19:24 UTC.
| Model | All tokens | API list value | Value share |
|---|---|---|---|
| Fable 5.1 | 413.90M | $374.98 | 48.42% |
| Sonnet 5 | 823.43M | $306.73 | 39.60% |
| Opus 5 | 18.82M | $92.77 | 11.98% |
| Total | 1.256B | $774.49 | 100% |
Token count alone is misleading: cache reads cost 2.5%–10% of base input depending on model. API-equivalent dollars are the correct normalized measure.
USD list pricing, billed annually. “U” is the user’s full monthly API-equivalent workload; “C” is Team usage-credit spend after included limits.
The base seat price is identical. Standard includes its normal allowance, but Fable usage on Standard seats consumes usage credits from the first token.
Premium includes the larger allowance. Fable is included for up to 50% of the weekly limit; usage after seat limits moves to credits.
| Full workload U / month | Usage-based Enterprise ($20 + U) | Team Premium | Team saving | Reading |
|---|---|---|---|---|
| $30 | $50 | $100 | −$50 | Standard is a better fit |
| $80 | $100 | $100 | $0 | Premium break-even |
| $250 | $270 | $100 | $170 | Conservative heavy-user case |
| $500 | $520 | $100 | $420 | Strong Team case |
Adjust seat mix, full API-equivalent workload and actual Team usage-credit spend. This excludes negotiated Enterprise discounts and taxes.
Team: $100 Premium / $20 Standard + actual net usage-credit spend. Usage-based Enterprise:
$20 access + the full modeled workload from the first token.
Organization count is ceil(seats / 150).
| Seats | Team orgs | Team / month | Team / year | Usage-based Enterprise fixed floor | Aggregate full workload at break-even |
|---|---|---|---|---|---|
| 5 | 1 | $500 | $6,000 | $100/mo | $400/mo |
| 50 | 1 | $5,000 | $60,000 | $1,000/mo | $4,000/mo |
| 150 | 1 | $15,000 | $180,000 | $3,000/mo | $12,000/mo |
| 300 | 2 | $30,000 | $360,000 | $6,000/mo | $24,000/mo |
| 450 | 3 | $45,000 | $540,000 | $9,000/mo | $36,000/mo |
Every section below is shown in full.
chargebee.com
Anthropic documents
that domain verification lives at the parent-organization level. Another parent cannot claim
chargebee.com, but multiple Team/Enterprise organizations can share one parent’s domain and SSO.
Existing parent retains verified chargebee.com and current IdP.
Enterprise owner invites each Team organization into the parent.
Unique IdP group per Team org; Team uses JIT rather than SCIM.
@chargebee.com users switch between authorized orgs.
chargebeeinc Team org does not currently have
chargebee.com as an allowed domain under the same identity parent. Direct invitations and invite
links still check the invitee’s domain against the destination organization’s allowed domains
(invite-link rules).
Meanwhile, chargebee.com is already verified by the Enterprise parent, and another parent cannot
claim it. If Enterprise domain capture is active, new chargebee.com accounts are also routed
directly through Enterprise SSO
(domain-capture rules).
chargebeeinc identities.| Attempt | Expected result | Technical reason | Correct action |
|---|---|---|---|
Add @chargebee.com directly to the unrelated chargebeeinc Team org |
Needs parent linking | The destination org’s parent does not own that domain; another parent already verified it. | Merge/link the Team org into the existing Enterprise identity parent first. |
| Use “Continue with Google” | No topology change | Authentication proves identity; it does not change Anthropic domain ownership, allowed-domain checks or parent membership. | Use the corporate IdP configured on the shared parent. Google Workspace could be that SAML IdP, but changing IdPs is unrelated to this fix. |
| Invite using an org link | Requires allowed domain | Invite links only work when the invitee matches the organization’s allowed domains. They are unavailable entirely when SSO is enabled. | After parent linking, provision through SSO/JIT and mapped IdP groups. |
| Link Team org under Enterprise parent | Supported path | Linked organizations share domain verification and SSO while retaining separate billing and usage. | Satisfy merge prerequisites or ask Anthropic Support to detach/migrate the POC org. |
chargebeeinc identities, a self-service merge may not be available. The clean options
are Support-assisted detachment/owner migration or creation of a fresh Team child under the Enterprise parent.
Copy/adapt this; it asks for topology support, not special permission to own multiple teams.
Team owners get per-user, per-model, per-product tokens, request counts, gross/list value, net spend, adoption and Claude Code value metrics. CSV export is built in with a one-day delay.
Team and Enterprise both support Claude Code settings fetched from Anthropic at startup and refreshed hourly. Use forceRemoteSettingsRefresh where failure must be closed.
Deploy Claude Desktop’s official macOS .pkg with Jamf. Put Code policy in /Library/Application Support/ClaudeCode/managed-settings.json or managed-settings.d/.
Export tokens, cost, sessions, model, prompts, API errors, tools and permission decisions. Lock endpoint/protocol/credentials in managed settings.
Team admins configure an OTLP endpoint directly in Organization settings. It streams prompts, tools, MCPs, files, approvals, token counts and cost across local/cloud Cowork.
Team has SSO, domain verification, just-in-time provisioning and group mappings. SCIM is absent, but normal user creation and org targeting are covered.
Team, OTEL and managed-device controls cover most coding-tool operations. Enterprise remains the native option when Chargebee needs vendor-side identity lifecycle, content retrieval or specialized compliance controls.
| Enterprise capability | Meaning | Team approach | Difference to accept | When it matters |
|---|---|---|---|---|
| SCIM | IdP pushes create/update/deactivate into Claude without the user logging in. | Operational alternative SSO enforcement + JIT + group mappings + daily membership reconciliation/manual removal. |
No supported Team SCIM endpoint; account may remain a member after IdP removal; more admin toil across orgs. | Not a legal mandate. Nice at 400–500; unnecessary to block 5–150. |
| Audit logs + Compliance API | Vendor-side activity plus privileged read/delete access to chats, files and projects. | Broad operational coverage Code OTEL + Cowork OTEL + Team analytics cover agent activity/cost. |
Blind spot for complete claude.ai chat/file corpus, central eDiscovery, server-side deletion and some admin events. | Low–medium for Code-only. High if staff paste customer material into web chat or Legal requires eDiscovery. |
| Analytics API | Programmatic API for aggregate usage/adoption/cost. | Available through existing stack Team dashboard + spend CSV + OTEL warehouse. |
CSV is delayed/manual unless separately automated; dashboards split by Team org. | No blocker if central OTEL pipeline is implemented. |
| Custom retention | Anthropic automatically retains/deletes stored data on a customer-defined schedule. | Enterprise-native On Team, minimize data, restrict allowed surfaces, and use API/ZDR for exceptional sensitive flows. |
Team stays on Anthropic’s default retention. Local deletion does not delete vendor-side content. | Only required if Chargebee policy/contracts set a vendor retention maximum. |
| CMEK | Anthropic encrypts supported stored data using a key in Chargebee’s AWS/GCP/Azure KMS. | Enterprise-native Use Anthropic-managed encryption on Team or select Enterprise when customer-held keys are required. |
No Chargebee-controlled crypto kill switch or KMS audit trail. | Optional unless vendor-risk policy or a customer contract explicitly requires customer-held keys. |
| HIPAA-ready + BAA | Contract and restricted configuration allowing eligible Claude features to process PHI. | Enterprise-native Keep PHI out of Team; route approved PHI workflows to BAA-covered Enterprise/API. |
Team cannot legally be used for PHI-dependent workflows. | Not needed for normal coding if PHI is prohibited. Chargebee product HIPAA support does not automatically extend to employee tools. |
| US-only inference | Anthropic constrains model inference geography to the US. | Enterprise-native | No hard inference-residency guarantee from Team. | Only if contractual/data-residency policy explicitly requires it. |
| Custom roles | More granular admin privileges beyond Team’s basic Owner/Admin/User roles. | Operational alternative Minimize owners; central operating runbook; separate admin-only accounts. |
Less granular separation of duties. | Security review item, not an automatic blocker. |
| One org above 150 | Single governance, billing and usage boundary for all users. | Multi-org design Multiple Team orgs under one identity parent; aggregate OTEL. |
Separate invoices, dashboards, seat pools and 150-seat boundaries. | This is the main deliberate operating tradeoff. |
SSO proves who a user is. JIT creates them on first login. SCIM keeps the SaaS directory synchronized even when nobody logs in—especially deactivation. Team has SSO/JIT but not SCIM. Keeping Okta still has value: denying the Anthropic app centrally blocks future SSO, while a reconciliation process removes stale Team membership and frees the paid seat.
This provides privileged content access beyond telemetry. A compliance key can access chats and files a primary owner has never viewed and can delete content. OTEL records events emitted by Code/Cowork; it is not a guaranteed export of every object Anthropic stores. This distinction matters when web chat is used for sensitive work or Legal requires content retrieval.
Anthropic normally controls the at-rest encryption keys. CMEK delegates the wrapping key to Chargebee’s cloud KMS. Enabling it is a long-lived workspace choice: losing or revoking the key can make data unavailable, and some search, analytics or export features may change. It is not a DLP system and does not stop sensitive text from being sent.
HIPAA applies to identifiable health information handled for covered entities/business associates. A BAA is the contract defining that responsibility. Chargebee’s ability to sign BAAs for the core billing product is separate from whether an engineer may paste PHI into Claude. If Team policy says no PHI, HIPAA-ready Claude is unnecessary. If support/engineering needs real PHI, use only Anthropic’s currently BAA-covered Enterprise/API features after Legal approval.
org_id, user, model and cost dimensions.| Control loop | Frequency | Implementation | Failure response |
|---|---|---|---|
| Identity/offboarding | Daily + termination event | Compare IdP groups with each Team member export; remove stale members; enforce SSO. | Disable IdP immediately, revoke sessions where supported, remove Team membership same day. |
| Spend/value | Daily/weekly | Team spend CSV + OTEL cost.usage; pin official model price table. | Move user Premium→Standard at renewal or cap credits; investigate runaway agent loops. |
| Policy | Startup + hourly refresh | Server-managed settings plus Jamf endpoint-managed fallback. | Use fail-closed refresh for mandatory settings; alert on claude doctor failures. |
| Data leakage | Real time | OTEL events → SIEM; collector-side redaction; EDR/DLP; deny sensitive paths/tools. | Stop session, revoke access, investigate via available events; Enterprise needed for full chat corpus. |
| Seat utilization | Monthly | Classify Standard/Premium using API-equivalent value and limit-hit rate. | Reassign paid seats; schedule allocation reductions before annual renewal. |
The mixed POC workload produced $774.49 of API-list value, well above the $80 monthly threshold. Confirm how much remained included versus paid Team credits before quoting savings. At zero Team credits, 50 Premium seats break even at $4k aggregate full workload.
The present sample is one dominant heavy user and 87 subagents. Gather all five users via built-in spend export before sizing Standard/Premium mix.
Use real @chargebee.com identities, shared SSO and group mappings. Treat chargebeeinc dummy identities as temporary migration debt.
Vendor documentation and local metrics were checked on 15 September 2026.