The governed operations stack

Three of the four tools, Glean, Guru and Vanta, are quote-based enterprise platforms with no list price; Claude Cowork has published tiers. The 03 COSTS table above breaks down each tool. Three of the four publish no pricing at all: Glean, Guru and Vanta are sales-led purchases sized to the organisation, and evaluating them is a procurement exercise with a real sales cycle. The Claude plan carrying Cowork is the one predictable line. Budget the internal time (security review, legal, connector work) as part of the cost, because at this tier it usually exceeds the first month's software.

No, and the sequencing follows the pain. If people cannot find what exists, Glean leads; if they find things but cannot trust them, Guru leads: the two problems feel similar and are not. Vanta's timing is set by the audit calendar and customer security reviews: start well before the first SOC 2 deadline, not at it. Cowork lands last, once the folders, permissions and approval gates it should operate under actually exist.

Then the finding problem is solved, and this stack works on what search alone cannot: whether what you find is true, and whether you can prove what the organisation does. Guru adds the verification layer (content actively maintained, flagged when stale) above the estate Glean indexes. Vanta turns compliance from an annual scramble into collected evidence. And Cowork puts a governed agent to work inside the permissioned world the search layer already respects.

Glean and Guru both answer questions from company knowledge with citations and permissions, the one real overlap, and a deliberate one. The dividing rule is curation. Glean searches everything the connectors reach and answers from what exists; Guru answers from what the organisation has verified, and actively maintains that content, auto-verifying, merging duplicates, flagging staleness. Broad questions go to search; anything where a wrong answer costs money goes to the curated layer.

Often, and this tier says so plainly. The machinery here (organisational-scale indexing, named verification owners, continuous compliance, security-reviewed agent deployment) assumes hundreds of seats and a real IT function. Two signals say you have overshot: no auditor, regulator or enterprise customer is asking for evidence, or nobody owns knowledge management as an actual job. A team reaching for governance it does not need wants the competitive tier, the professional operations stack.

More than at any other tier: that is largely what the tier buys. Permission-awareness is structural in Glean and Guru: each person sees only what their access allows, and Guru adds SOC 2 Type II, HIPAA readiness, SSO and audit trails. Vanta exists to evidence exactly these controls. The residual discipline is the agent: scope Cowork's folders and connectors deliberately, keep its approval gates on for anything consequential, and run it on the enterprise terms that exclude your data from training.