An AI prototype can produce a useful answer without storing the request, checking who submitted it, or recording who approved it. Those gaps matter when employees start relying on the application.

In this course, you will work on Vendor Review, an internal application for requesting new software. A model identifies missing information and suggests a risk level. Written policy determines which requests need Procurement or Security review, and an authorized person approves or rejects them.

You will deploy the prototype, restrict access, test its behavior, and make approval work even when a reviewer takes days to respond. Then you will add a small intake agent that gathers request details and asks permission before submitting. It cannot approve a vendor.

The course uses the capabilities introduced in Vercel for Enterprise Apps and Agents. Each lesson addresses a specific application problem; the final exercise asks whether your results justify a broader rollout.

Before you begin

For the implementation exercises, you need:

Node.js 24 or later and pnpm
GitHub and Vercel accounts
Comfort reading TypeScript in a Next.js project
An AI Gateway API key for local model calls, the eve agent, and live evaluations
A Postgres provider from the Vercel Marketplace for the database lab

Deployments on Vercel use platform-issued, short-lived OIDC identity for model calls unless you configure an API key.

Some exercises require enterprise access. Vercel Passport puts internal applications and agents behind your identity provider and is available on Enterprise plans. Enterprise Managed Users, which manages builder accounts through the company directory, is an Enterprise Private Beta. If you cannot configure a control, use the architecture exercise and record it as demonstrated or planned, not implemented.

What you will learn

By the end of the course, you will be able to:

Explain what changes when a prototype becomes a company application
Control who can build the application, who can use it, and what systems it can reach
Separate company policy from model judgment
Test, record, and observe AI-assisted decisions
Make human approval survive delays and record who approved
Build a small eve agent with one submission tool, stop conditions, and human approval
Decide when a workflow has actually become an agent
Demonstrate whether the application is ready for a broader rollout

The application

The application follows this sequence:

Employee submits a vendor request
  → company policy chooses required reviewers
  → AI identifies ambiguity and suggests risk
  → a durable workflow waits when review is required
  → an authorized person approves or rejects
  → the application records the evidence

You will configure or plan access separately for builders, employees, and the application:

builders and deployers → organizational ownership and protected delivery
employees              → application access policy
application            → scoped data, tools, models, and spend

An employee should not need deployment privileges to submit a request. The application should have access only to the company systems it needs. Platform and security teams set these requirements and review changes such as access to sensitive data or expansion to a new audience.

Work in the course repository

The course repository keeps one application at the repository root:

main is the deliberately incomplete prototype and the course starter.
implementation-start is a tagged scaffold with the request UI and application plumbing needed for the implementation chapter. It contains unfinished model, policy, and workflow behavior.
complete is the finished answer key.

Create a course-work branch from main and keep it for the whole course. Record requirements and results in the starter's three documents: docs/readiness.md, docs/model-record.md, and docs/operating-report.md. Use actual deployment checks, test output, and request records to support your conclusions.

Course map

From Prototype to a Production Path — deploy Vendor Review, define its job, and find the gaps that matter.
Create One Governed Path — control builder identity, employee access, and access to company systems.
Make AI Decisions Dependable — choose models deliberately, encode policy, test behavior, record approval decisions, and add one small eve agent.
Prove It Is Ready — run one request from intake through a recorded human decision, inspect the evidence, and decide whether to keep testing, roll it out more broadly, or retire it.

The main path is written for anyone who needs to understand how enterprise AI applications reach production. Implementation details are included for developers, but the architecture and decision exercises stand on their own.

Start by deploying the prototype and observing what it can prove today and what remains unknown.