Who builds and owns it

Vendor Review has two assets that can outlive its creator: a source repository and a Vercel project. If either belongs only to a personal account, offboarding becomes an emergency transfer instead of a routine directory event.

Test the ownership handoff

Assume the current technical owner becomes unavailable today. Give yourself five minutes and, without using knowledge that exists only in your head, locate:

The source repository and production branch
The Vercel project and the team that owns it
Production environment-variable ownership
Deployment-protection settings
Build and runtime logs
The person authorized to ship an emergency fix

Mark each item team-owned, person-dependent, or unknown. Anything in the last two categories is a concrete transfer gap.

Record the handoff result under Builders and owners in docs/readiness.md:

Source organization:
Vercel team:
Application owner:
Technical owner:
People allowed to deploy:
Transfer procedure:

The application owner is accountable for the business process. The technical owner is accountable for its operation. Neither field should be “whoever created it.”

Choose your path

Verify: If your organization uses Enterprise Managed Users, locate the directory group that grants access, the Vercel team role it maps to, and a recently removed test user or equivalent lifecycle evidence.

Design: If you do not have that environment, use the ownership handoff above. Record the intended directory group, team role, owner, and removal trigger as planned. You can finish the course without an Enterprise account; you just cannot claim this control is implemented.

Managed builder identity

Enterprise Managed Users connect builder accounts to the company directory. The organization controls account creation, role assignment, and deactivation. Repositories and projects remain with the organization when they were created in organizational scopes rather than personal accounts.

Enterprise Managed Users is in Private Beta for Enterprise customers. It requires enforced SAML SSO, active Directory Sync, and at least one verified domain. If you do not have that environment, this lesson is an architecture and evidence exercise rather than a configuration lab.

This is different from application access. EMU answers who may build, configure, and deploy. It does not decide which employees may submit a vendor request.

Company directory
  └─ managed builder account
       ├─ team role
       ├─ repository access
       └─ deployment and configuration access

If you do not have EMU, document the equivalent course setup as implemented for the lab and the directory-managed target as demonstrated or planned. Do not mark enterprise lifecycle management implemented on the strength of a personal account.

Least privilege for builders

Review who can:

Merge to the production branch
Change environment variables
Change deployment protection
View production logs
Transfer or delete the project

The roles need not be identical. A developer who can create a preview does not automatically need authority to change production identity policy.

Evidence

Add the ownership record and a dated handoff test to docs/readiness.md:

If the current technical owner left today, which named team would retain the repository, deployment settings, secrets, logs, and ability to ship a fix?

If the answer depends on contacting that person, the gap remains open. Repeat the handoff check after changing the ownership design; the second attempt should be possible using only the repository and organizational systems.

Commit the ownership result:

git add docs/readiness.md
git commit -m "docs: record application ownership"

Summary

Enterprise Managed Users connects builder access to the company directory. When someone changes roles or leaves, their ability to change applications follows the same managed identity lifecycle instead of depending on a personal account.

Check your work

Ask a teammate to find the source repository, production project, environment settings, logs, and emergency shipper using only the record you wrote. Anything they have to ask you for is person-dependent. Fix the record or mark the ownership gap planned.