Skip to main content
reopt Handbook
reopt Handbook
Vercel Enterprise AI Platform

Platform Foundation

Platform ArchitectureAI SDK RuntimeAI Gateway Control Plane

Execution Runtime

Workflow Durable ExecutionSandbox Tool RuntimeMCP Enterprise DataQueues and Async Jobs

Prompt and Quality

Prompt Engineering and GuardrailsRAG and Retrieval-Augmented GenerationObservability and Evaluation

Operations

Security GovernanceCost and ReliabilityDeployment and AI CI/CD

Scenarios

Customer Support Agent ArchitectureInternal Research Agent ArchitectureApproval Backoffice AutomationCoding Orchestration

Orchestration Patterns

Graph-Centric OrchestrationPractical Orchestration PlaybookMulti-Agent Architecture

Appendix

Migration GuideReferencesVerificationUpdates
Handbook›Vercel Enterprise AI Platform›Security Governance
한국어KOEnglishEN

Security Governance

Govern identity, secrets, provider policy, data handling, WAF, BotID, and approvals.

Written and reviewed by Eric Han · Co-founder & CTO, reopt

Key takeaways

  • Security governance defines what AI systems may access, which providers they may use, and which actions need human or policy approval.
  • Core controls include OIDC identity over long-lived credentials, secret management, centralized gateway policy, WAF and BotID, approval gates, and audit logs.
  • Approval gates prevent uncontrolled side effects, while audit logs record user, model, tool, and workflow actions for evidence.
  • The risk review asks which data classes the flow can reach, which tools mutate state, which provider and region policies apply, and who owns incidents.

Framework patch review — 2026-10-23

Replace the old 16.2.3 floor with a review of the deployed dependency graph, enabled features, and the current Next.js advisories.

AdvisoryRelevant conditionPatched version for this advisory
Image Optimization SVG RCE, October 14Upstream image-processing library on glibc Linux15.5.28 / 16.4.1; verify sharp 0.35.5+
use cache typed array RCE, October 14Affected use cache paths16.4.1
next/og ImageResponse RCE, September 22Attacker-controlled SVG values in the Node.js implementation16.3.6

This is a selection, not a complete vulnerability inventory. The current documentation lists 16.4.2. Review every applicable advisory, choose a supported patched release, and verify the lockfile, deployed artifact, and regression results. WAF rules do not replace dependency patches.

Security governance defines what AI systems may access, which providers they may use, and which actions require human or policy approval.

Governance Controls

ControlPurpose
OIDC and identityAvoid long-lived deploy credentials
Secret managementKeep provider keys out of source and prompts
Gateway policyCentralize provider and model access
WAF and BotIDProtect public AI endpoints
Approval gatesPrevent uncontrolled side effects
Audit logsRecord user, model, tool, and workflow actions

Risk Review

  • Which data classes can the AI flow access?
  • Which tools can mutate state?
  • Which provider and region policies apply?
  • Who owns incidents and escalations?
  • What evidence proves the control worked?

Related docs

Security Governance

Enterprise Project Architecture · Manage secrets, access, dependencies, permissions, and approval rules in enterprise projects.

Verification

A checklist for validating an enterprise AI platform on Vercel.

AI Gateway Control Plane

Centralize model routing, provider fallback, usage policy, and cost governance.

CRM Strategy

CRM Standard · Align CRM purpose, ownership, and priorities from a leadership perspective.

Access Control and Secrets

AI Security and Compliance Operations · Govern human, service, and agent permissions with least privilege and rotation.

Observability and Evaluation

Connect traces, prompts, tool calls, quality scores, latency, and cost.

Cost and Reliability

Manage AI cost, latency, error budgets, rate limits, fallback, and workload classes.

On this page

Framework patch review — 2026-10-23Governance ControlsRisk Review