Threat model for copilots

Start with who can prompt, what the copilot can touch, and what a prompt injection would try to do. Draw it. If it does not fit on one page, you do not have a model — you have a hope.

Assume the untrusted text is in the retrieved document, the ticket, and the user’s paste. Treat those as hostile until parsed.

Copilots fail at the boundary between “help” and “authority.” Mark that boundary in the product, not the brand.