The four options you usually get

Every trainer who teaches cloud recognises all four, and none of them is good.

A simulator

Nobody in the room believes it. The learner who has already used the real console can see the seams, and the learner who has not is being taught a thing that does not exist outside the classroom.

A shared sandbox

One learner deletes a network, changes a quota or exhausts an address range, and the exercise stops for the other twenty-nine. You spend the afternoon debugging your own lab rather than teaching.

The learner's own account

Which means card details, a billing account per person, and a bill that keeps running long after the course ends. In several of the markets we care about, the learner cannot complete that step at all.

Hand-built labs

A day of setup before every cohort and scripts that drifted since the last one. The infrastructure is real, but you author it again for each delivery and you own every failure in the room.

Then there is the option nobody lists, because it happens after everyone has gone home: cleanup. Finding what was left running, in whose account, and turning it off before it becomes an invoice.

What a cohort deploy actually does

It is the ordinary RAD deploy form, with a roster attached to it.

Deploy-on-behalf works only into RAD-managed projects. If the RAD-managed option is switched off, the participants you had selected are cleared from the form with it — a trainer cannot provision into a participant's own Google Cloud account.

What the lab tier actually restricts

Mechanisms, not adjectives. These are org policies applied to the folder the lab projects are created in.

Guardrails

  • External IP addresses are denied
  • The default network is suppressed
  • Serial port access is disabled
  • Service-account key creation and upload are blocked
  • Public storage buckets are prevented
  • Public Cloud SQL IP addresses are refused
  • The Google Cloud services that can be enabled are restricted to an allowlist
  • Resource locations are restricted to the permitted regions

Where it runs

  • RAD-managed regions8
  • Americasus-central1
  • Americasnorthamerica-south1
  • Americassouthamerica-west1
  • Europeeurope-north2
  • Middle Eastme-west1
  • Africaafrica-south1
  • Asiaasia-east1
  • Oceaniaaustralia-southeast2

One region in each of eight geographies, chosen as the cheapest available region in that geography as measured from the Cloud Billing Catalog API. africa-south1 is the only Google Cloud region on the African continent. A deployment into a participant's own project keeps every region Google offers.

Spend visibility

  • Each tier carries a monthly Google Cloud budget that raises alerts as spend approaches and exceeds it. Be clear on what that is: a Google Cloud budget notifies. It does not block an API call.
  • The enforcement mechanism is separate. RAD is designed to suspend billing on a managed project if the owner's purchased credit balance goes negative, and to restore it after a top-up. It only ever reverses a suspension it applied itself.
  • Every deployment writes a credit transaction, so a participant — and you, for what you provisioned — can see what each exercise cost.

Who owns it, and who pays for it

This is a commercial fact rather than a footnote, so it belongs here rather than at the bottom of a pricing page.

What a trainer can and cannot do

The trainer role on its own grants nothing. Visibility is derived from the roster, and it is re-checked on every request.

A trainer can

  • Provision a deployment for every participant on the roster in one action
  • See the deployments they provisioned, and follow their status while they build
  • Tear those deployments down when the course ends

A trainer cannot

  • Read a participant's configuration values or deployment outputs — secrets are restricted to the owner and to administrators
  • See anything belonging to someone who is not on the roster
  • Provision into a participant's own Google Cloud account
  • Retain access after a name is removed from the roster
  • Look up accounts outside the roster — the deploy form gives a trainer a chooser over their own participants, not a user search

End of term

A roster does not lapse on its own — it stands until someone clears it. Clearing it is one edit: ask an administrator to empty the list at the end of term, or to strike a single name for a participant who leaves in week two. Because access is derived from membership rather than held as a separate permission, that one edit is the whole revocation, and it takes effect on the next request.

That is also the answer to the question a security reviewer asks: a trainer's reach is a function of one list, held on their own account and maintained by an administrator, and it is recomputed on each request rather than remembered.

A multi-application capstone, not a single container

The catalogue carries 62 pre-composed solutions, counted 2026-08-17, and a solution can be provisioned for a cohort in the same way a single module can.

Several applications, ordered

A solution averages 4.7 applications, ranging from 3 to 8, provisioned three at a time into one project. A member that consumes another member's Terraform outputs waits for that specific deployment to finish; the rest start as soon as the solution is confirmed. Across all 62 solutions the catalogue defines 291 member deployments drawn from 151 distinct applications.

Eight pairs are wired, the rest are an exercise

For eight producer-and-consumer pairs, a solution is designed to write the producer's real Terraform outputs into the consumer's configuration when it finishes — Elasticsearch into RAGFlow and Zammad, Ollama and LiteLLM into OpenWebUI, ClickHouse into Plausible, Synapse into Element, Gitea into Woodpecker, Directus into Meilisearch. Those pairs appear in eight of the 62 solutions; in the other 54 every connection between members is done by hand afterwards, which for a class is a teachable step rather than a gap. The automatic part is a beta capability; verify it in a pilot rather than assume it.

Torn down in reverse

Teardown runs the dependency graph backwards, so the shared project is destroyed after the things living inside it rather than before them. For a cohort that is the difference between a clean end of term and thirty half-deleted estates.

A solution deployed as a capstone is charged as one reservation across all its members, with a bundle discount of 15% for 3–4 modules, 20% for 5–6 and 25% for 7 or more — debited, as always, from each participant.

The written curriculum already exists

Counted 2026-08-17 on docs.radmodules.dev. Every figure below is a page count you can go and check.

346 hands-on deployment labs

Each one ends in something running rather than in a diagram. They map onto the same catalogue your cohort deploys from, so the lab a participant reads and the form they fill in are the same subject.

523 module configuration guides

One for each of the 346 application options, plus 177 shared foundation guides those options build on. They list the variables the deploy form will ask about and what each one does — useful as pre-reading and as the answer to "what does this field mean?" while you are teaching.

41 certification study guides

Aligned to seven Google Cloud certification tracks: ACE, PCA, PCD, PCDE, PCNE, PDE and PSE. Each track's guide defines deployment profiles built from the foundation modules and maps the exam domains onto them, so a section can be taught as reading plus a real deployment rather than reading alone.

Read this before you plan a cohort around it

RAD is in beta, and cohort provisioning is the newest part of it. The honest state of the feature, stated by us rather than discovered by you.

RAD is in beta. The platform, catalogue and documentation described here are built and running; features marked as early access are newer and we say so where that is true. Catalogue figures counted 2026-08-17.