Inside Vercel’s AI workflow: 7 practical tips for building better apps with agents

AI coding agents can now ship features in minutes, but that speed creates a new problem: it’s easy to build a lot and still go nowhere. Vercel’s CEO recently shared how he actually works with agents day to day, and his approach is less about “how much code did we ship?” and more about “are we still building the right thing, safely?”

Here are seven practical ideas from his workflow that you can copy into your own stack.

1. Test ideas with tiny projects and MVPs

Instead of debating prompts on social media or trusting what “everyone says” about a model, he spins up a fresh project for each new idea and tests it from scratch with an agent.

The core principle: don’t go off vibes. Don’t assume a prompt style, model, or architecture is better because a guide said so. Let reality decide.

A simple way to mirror this:

• Start every idea with a short product requirements document (PRD) in a specs folder.
• Ask your coding agent (like Claude Code) to build an MVP based on that PRD.
• Use this MVP as a reality check: is the idea still worth building now that you can actually click through it?

By validating the idea with a minimal working version, you avoid sinking weeks of agent-generated code into something that was flawed from the start.

2. Measure direction, not just activity

Most teams still judge their AI productivity by surface numbers: tokens used, PRs merged, features shipped. Those metrics only tell you how much you’re doing, not whether you’re moving in the right direction.

With agents, building is cheap. Every passing idea can become a feature in minutes. That’s exactly why you need a way to check: is this still aligned with the original plan?

The solution is a simple but powerful pattern: a direction command.

Here’s how it works conceptually:

• Keep your plans in a dedicated folder (PRD, requirements, specs).
• Ask your agent to create a custom command (for example, called direction) that knows where this folder lives.
• When you run that command, it spins up sub-agents to read each requirement document and compare them to the current codebase and feature set.
• The main agent then produces a report: where the app has drifted, which features don’t match any spec, and a scorecard of how closely the build matches the plan.

From there, you decide: either update your specs to reflect intentional changes, or roll back features that pulled you off course.

This “direction over volume” mindset lines up with what many engineering leaders are now realizing: software fundamentals matter more than ever in the age of AI coding.

3. Get ahead of security debt with automated scans

AI agents are writing more code than humans ever could, which means your potential attack surface is growing just as fast. At the same time, attackers now have access to the same models to hunt for vulnerabilities.

The CEO calls this growing pile of risk security debt: all the security issues that quietly accumulate as agents keep shipping code.

His advice is twofold:

Run security scans after every feature

Vercel built an internal tool called DeepSec to scan agent-written code for security gaps. The basic idea can be replicated with any security scanner:

• When a feature is done, run an automated security scan over the codebase.
• Have your agent summarize the report and propose fixes.
• Only merge once critical issues are addressed.

With DeepSec specifically, you:

• Run a setup command to create a .deepsec folder in your project.
• Paste a generated prompt into Claude Code so it can describe your app and auth flows.
• Ask Claude to run the scan and then review the resulting report.

Know where you can (and can’t) accept “slop”

He also talks about slop debt: the messy or rushed code you knowingly accept to move faster. A bit of slop in a tiny internal tool is fine. In core flows that handle customer data, it’s dangerous.

The key is to define quality levels ahead of time using quality gates:

• Critical paths (auth, payments, data access) must pass stricter checks: security scans, review agents, and tests before going live.
• Less critical surfaces can have lighter-weight checks to keep velocity high.

Think of it as a minimum bar per area of your app, enforced by agents before deployment.

4. Decide what you will never trade off

Every product decision is a trade-off: speed vs. polish, cost vs. features, safety vs. time-to-market. Agents are constantly making micro trade-offs on your behalf in how they implement things.

If you don’t tell them what must never be compromised, they’ll optimize for whatever seems easiest from their point of view.

The fix is to explicitly codify your non-negotiables.

In his workflow, these are written into a claw.md file at the root of the project with a special section like “must not trade off”. This might include:

• Performance targets (e.g., page must load in under X seconds).
• Security rules (e.g., never log sensitive data).
• UX constraints (e.g., sign-up must be possible in under three steps).

But instructions alone aren’t enough. Agents forget. To make these rules stick:

• Pair each rule with a way to test it (unit tests, integration tests, performance checks).
• Commit those tests to your repo so the agent can’t silently ignore them.
• Use your earlier direction command to verify that new changes still respect these non-negotiables.

This turns vague values (“security matters”) into concrete gates that every agent-generated change must pass.

5. Use a “breaker agent” to attack your own app

Most AI-written code works great when everything goes right. The real world is the opposite: users click things out of order, open multiple tabs, spam buttons, or hit your app under heavy load.

When Vercel ships something new, they don’t just check the happy path. They unleash an agent whose job is to break the product.

You can do the same by creating a dedicated breaker agent with one mission: act like a hostile user and stress test your app.

Conceptually, this agent should:

• Copy or seed data so it never touches your real production data.
• Hammer your app with concurrent actions, weird sequences, and edge cases.
• Measure performance under load and compare against expectations.
• Report every way it managed to break or slow down the system.

Once the breaker agent finishes, your main agent can:

• Fix the issues it found.
• Re-run the breaker tests to confirm the problems are actually gone.
• Optionally loop: break → fix → re-test until the system hardens.

This mindset—deliberately trying to break your own AI-built product—will increasingly separate teams that survive from those that ship fragile systems. It also echoes a broader warning many leaders are raising about AI hype and fragility, as explored in this deep dive on why many CEOs still don’t really get AI.

6. See your product like a first-time user

Once you’ve lived inside an app for weeks, you can never again experience it like a new customer. You know every button, every quirk, every workaround. That makes you blind to the places where new users get stuck and quietly churn.

One of Vercel’s core values is “know your customer,” and in the AI era that means using agents to simulate real user journeys.

Agent 1: the true first-time user

To get honest feedback, you need an agent that only sees what a new user sees. That means:

• It runs your app in a browser.
• It is blocked from reading or editing your code.
• A hook prevents it from using tools like bash for anything except starting the app.

Its job is to:

• Walk through the product without prior knowledge.
• Note confusing steps, unclear wording, or dead ends.
• Report where it got stuck or what was unintuitive.

This is how you uncover issues like a sign-up field that makes no sense to a new user, or a flow that only “works” if you already know the product.

Agent 2: the error-free sessions tracker

The CEO also tracks a metric he cares a lot about: error-free sessions. That’s how many users can complete a full journey in your app without anything breaking.

To measure this, you can have another agent:

• Run browser-based tests that follow the critical paths users must complete (sign-up, purchase, core workflows).
• Log which steps are slow, broken, or flaky.
• Save results in a structured format (like JSON) so you can track trends over time.

When a path fails, the agent can propose or even implement fixes, then re-run the tests to confirm everything is stable before you ship.

Combined, these two agents give you both qualitative insight (“this feels confusing”) and quantitative assurance (“this flow now works 99% of the time”).

7. Turn customer feedback into an automated fix pipeline

The last piece of the workflow is how you handle real-world feedback once your product is live. The CEO suggests you can judge a company’s AI maturity by watching what happens when a customer reports a problem.

Questions to ask yourself:

• Does someone respond quickly and clearly?
• Does anyone actually investigate what went wrong?
• If it’s a real bug, how long until it’s fixed in production?

Not all feedback is equal, so your system needs to treat it differently.

Connect agents directly to your feedback streams

Using MCP (Model Context Protocol) servers, you can plug your agent into the tools where feedback and errors show up:

• A Gmail MCP server to read support emails.
• A Sentry MCP server to stream application errors, even when users don’t report them.

Once connected, your agent can:

• Read each new report or error as it arrives.
• Classify it: is this an obvious bug, a user confusion issue, or something else?
• For clear, reproducible bugs (like a broken button or failing payment), immediately propose or apply a fix.
• For ambiguous issues (“I’m confused by this flow”), escalate to a human for judgment and product thinking.

This turns your AI stack into more than just a coding assistant. It becomes a continuous loop: observe real usage → understand issues → fix what’s clear → surface what needs human insight.

Bringing it all together

Underneath all seven tips is one big shift: AI coding isn’t about writing more code, it’s about building better systems around that code.

In practice, that means:

• Validating ideas with MVPs before you overbuild.
• Tracking direction, not just activity.
• Automating security and quality gates.
• Defining non-negotiables your agents must respect.
• Using breaker agents to stress test your own work.
• Simulating real users to improve UX and reliability.
• Wiring feedback channels straight into an agent-powered fix pipeline.

If you adopt even a few of these patterns, you’ll move from “playing with AI” to running a serious, agent-powered development workflow.