| name | vercel-enterprise-rbac |
| description | Configure Vercel enterprise RBAC, access groups, SSO integration, and audit logging.
Use when implementing team access control, configuring SAML SSO,
or setting up role-based permissions for Vercel projects.
Trigger with phrases like "vercel SSO", "vercel RBAC",
"vercel enterprise", "vercel roles", "vercel permissions", "vercel access groups".
|
| allowed-tools | Read, Write, Edit, Bash(curl:*) |
| version | 1.18.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","vercel","rbac","enterprise","sso"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Vercel Enterprise RBAC
Overview
Configure Vercel's role-based access control (RBAC) with team roles, project-level access groups, SSO/SAML integration, and audit logging. Covers the two access control planes: team-level (who can deploy) and application-level (who can access deployed content).
Prerequisites
- Vercel Pro or Enterprise plan
- Identity Provider (IdP) with SAML 2.0 support (for SSO)
- Understanding of your organization's access requirements
Instructions
Step 1: Understand Vercel's Role Model
Team-Level Roles:
| Role | Deploy Prod | Manage Projects | Manage Billing | Manage Members |
|---|
| Owner | Yes | Yes | Yes | Yes |
| Member | Yes | Yes | No | No |
| Developer | Preview only | Limited | No | No |
| Viewer | No | Read-only | No | No |
| Security (Enterprise) | No | Security settings | No | No |
Extended Permissions (Enterprise):
Layer on top of base roles for granular control:
- Deploy to production
- Manage environment variables
- Manage domains
- Access runtime logs
- Manage integrations
Step 2: Configure Team Members via API
curl -X POST "https://api.vercel.com/v1/teams/team_xxx/members" \
-H "Authorization: Bearer $VERCEL_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "developer@company.com",
"role": "DEVELOPER"
}'
curl -s -H "Authorization: Bearer $VERCEL_TOKEN" \
"https://api.vercel.com/v2/teams/team_xxx/members" \
| jq '.members[] | {name: .name, email: .email, role: .role}'
curl -X PATCH \
-H \
-H \
-d
curl -X DELETE \
-H
