Deploy the prototype

Vendor Review starts with one useful job: an employee describes a proposed software vendor, and AI identifies missing information and suggests a risk level.

Before improving it, establish what the application does today and who can reach it.

Deploy your copy

Deploy the main starter and create a copy in your GitHub account:

The flow forks the course repository into your GitHub account, creates a Vercel project from main, and deploys Vendor Review. Keep the project’s Root Directory at the repository root.

Run it locally

Clone the fork created by Vercel. The main branch is the starter, and the application lives at the repository root:

git clone <your-fork-url>
cd academy-enterprise-apps-agents
git remote add upstream https://github.com/vercel-labs/academy-enterprise-apps-agents.git
git fetch upstream --tags
git switch -c course-work
pnpm install
cp .env.example .env.local
pnpm dev

origin is your copy. upstream is the canonical course repository, which keeps the later reference branch and exercise checkpoint available even if the one-click copy begins with only main.

Add an AI Gateway key to .env.local, then submit three requests:

1. A low-cost design tool that handles no company data
2. A support service that handles customer contact information
3. An expensive analytics platform with an incomplete business purpose

Record the results you actually receive. Do not change the prompt to force a preferred answer.

Find the first production gaps

Trace one request through the code:

Refreshing the page clears the result. The application cannot yet prove what was submitted, which model produced the assessment, or what a person ultimately decided.

In docs/readiness.md, under Prototype baseline, record the three inputs, their results, and anything inconsistent or surprising. Use fictional vendor details throughout the course; do not submit company or customer data.

Protect the deployment

Open the Vercel project created by the button and confirm the production URL renders Vendor Review and can complete an assessment. Leave AI_GATEWAY_API_KEY unset in Preview and Production so the AI SDK uses the project’s automatically supplied Vercel OIDC identity. A static key is still appropriate for local development or a non-Vercel runtime.

The complete branch is the finished reference. Keep main as the production branch for this baseline project so a later branch preview does not silently replace it.

Before sharing the URL, follow the Deployment Protection instructions and enable Vercel Authentication for the URLs you intend to test. Standard Protection is available on all plans, but it does not protect a custom production domain. Protecting all production and preview URLs requires Pro with the Advanced Deployment Protection add-on or Enterprise. Verify the exact production and preview URLs in a private browser window and record which ones are protected.

Make one small change on a branch and confirm the pull request creates a protected preview:

commit → protected preview → review → merge → protected production

Add the production URL, the Vercel team that owns the project, the source repository, and the protection checks to docs/readiness.md.

Commit the baseline before the application changes:

git add docs/readiness.md
git commit -m "docs: record prototype baseline"

Summary

You now have a record of the prototype's behavior, its deployment URLs, and the team responsible for them. Deployment Protection limits who can reach the protected URLs; it does not add request storage or approval logic.

Check your work

Open the production URL in a private browser. It should require authentication. Then locate the exact Git commit behind that deployment in Vercel and name the team that can ship the next one. Record any URL that fails the private-browser check as a gap, and do not share it for internal use until protection is verified.