Description

Ensure only a small number of trusted administrators, typically two or three for backup, have the Owner role on the Vercel team. All other members should have the lowest role that still allows them to do their work, such as Member, Developer, Viewer, Billing, or Security.

Rationale

Owners have full control of the team, including billing, members, security settings, and every project. Each extra Owner is another account that an attacker could use to take over the whole team. Keeping the number of Owners small follows least privilege while still avoiding a single point of failure.

Impact

  • Reduces the number of accounts with full team control

  • Limits damage if an account is compromised

  • Supports least-privilege access

Default Value

By default, the user who creates the team is an Owner, and Vercel does not limit the number of Owners.

Pre-Requisites

  • Team Owner role

  • A list of users who need the Owner role

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Members.

  4. Count the members with the Owner role.

  5. If more members are Owners than required, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Members.

  4. Select Manage Role next to a member who does not need the Owner role.

  5. Choose a lower role, such as Member or Viewer, and save.

  6. Keep at least two Owners so the team is not locked out.

  7. If Directory Sync is enabled, change the role mapping in the identity provider instead.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Members.

  4. Select Manage Role next to the member, choose Owner, and save.

Reference