# Vercel's Tom Occhino on why access control is product architecture

DevFeed: [Vercel's Tom Occhino on why access control is product architecture](<https://devfeed.tech/articles/vercel-s-tom-occhino-on-why-access-control-is-product-architecture-1955.md>)

Original publisher: [Read original article](<https://1password.com/blog/secure-ai-development>)

Author: info@1password.com (Chris Fowler)

Published: 2026-06-02T00:00:00Z

Content type: article

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [vercel ai sdk](<https://devfeed.tech/topics/vercel-ai-sdk.md>), [Security](<https://devfeed.tech/topics/security.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Front end](<https://devfeed.tech/topics/frontend.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [developers](<https://devfeed.tech/tags/developers.md>), [frontend](<https://devfeed.tech/tags/frontend.md>), [podcasts](<https://devfeed.tech/tags/podcasts.md>), [policy](<https://devfeed.tech/tags/policy.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

## AI overview

This article examines Vercel's view that access control should be treated as product architecture in AI-assisted development. It discusses tool-using agents, the Vercel AI SDK, sandboxed execution, protection of production secrets and configuration, and authorization policies for outbound requests.

## Source excerpt

Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it's a builder's view of the architecture and the complex choices it takes to ship with AI. As Chief Product Officer at Vercel, Tom Occhino joined Zero-Shot Learning to discuss how AI is reshaping the developer workflow, from frontend architecture to v0, Vercel's production-ready AI coding assistant. What started as a conversation about AI-assisted development became a case for access control as a design decision, not a security afterthought. How AI changes the developer security model As part of the team that built and shipped React at Facebook, Tom helped replace MVC patterns with a component-based model that changed how an entire generation of engineers reasoned about interfaces. He calls what's happening now with AI-assisted development "a fundamentally different approach to software." Where the earlier shift changed how developers organized their thinking, this one changes who or what creates and operates software. In the past, a developer working on component architecture brought years of professional judgment to those decisions. Today, a non-technical worker using an agent in that same workflow does not, and when that agent can call tools, the gap can't be covered by training. Authorization has to be built into the architecture. Vercel's AI SDK makes it easier for agents to call tools, which adds to its appeal, but also means it requires stronger safeguards. "Putting on my security hat," Nancy said, "how do you make sure that these agents don't get exploited?" "Under no circumstances are we encouraging code execution on the client," Tom replied. Vercel builtSandbox because agent-driven development requires an environment without access to production secrets, environment variables, or configuration, so untrusted code doesn't touch production by default. Sandbox limits what an agent can re