Nobody is taking the copilot away — and nobody should. The skill that matters now is directing it: prompts that carry your threat model, reviews that catch what it invents, and a paper trail that keeps your name safe on the commit. This page is the working developer’s route in.
Written for the person whose name is on the merge commit.
The mental model: your assistant is prolific junior staff. Review it like staff, not like magic.
A working threat model, with tests you can paste into CI today.
Provenance discipline for generated code — declare it, trail it, triage it.
The 90-day rollout plan, the one-page policy, and the twelve questions to put to every AI-tooling vendor — assembled into a working document.