Threat model the copilot like any data pipeline
Internal copilots ingest PDFs, tickets, and wiki pages into embeddings and object storage. Risks include over-broad retrieval (junior staff seeing executive compensation), prompt injection via malicious documents, and accidental logging of PII to third-party LLM vendors.
Start with data classification: which corpora may enter the index, which roles may query which collections, and whether prompts/responses may be stored for training. Indian companies with DPDP obligations should document lawful basis and retention per corpus.
Non-negotiable controls
Authentication via SSO; authorization at retrieval time (filter chunks by team, region, or clearance). Encrypt at rest and in transit; prefer VPC-private endpoints for embedding and inference where available. Redact secrets at ingestion; scan uploads for malware.
Disable model training on customer data with vendor contracts. Maintain audit logs: who asked what, which documents were retrieved, not just chat UI history. Run periodic penetration tests on upload surfaces and admin APIs.
Launch gate and ongoing ops
Before go-live: red-team with injection prompts, verify refusal on out-of-scope questions, and confirm deletion propagates from source systems to vector index. Assign an internal owner for corpus updates and incident response.
Sabrixa delivers runbooks with every copilot engagement — how to rotate keys, purge a user session, and roll back a bad document batch — so security review is not a one-time PDF but an operable program.