@0xabad1dea @mcc speaking as somebody who is currently facing copilot in a commercial aspect, they've said it has tenant isolation repeatedly, and that *seems* to be true, but it does not seem to have functioning internal isolation controls. unfortunately I doubt I'm going to get to find out for real since the min spend is well into the six figures (for a mere 300 licenses minimum, a tiny, tiny fraction of our userbase)

my initial experiments when doing MS sanctioned labs were pretty dismal, though. I manually instructed a test interface to respond to me in a rude, condescending way just as a joke, before deploying a separate application in a separate resource group (supposed to be an internal boundary in this case, both for billing and ML learning, they told us). somehow, this rude behavior persisted when running the MS provided code not just for me but also for one of my coworkers who was running the same sample code in their own environment.

also their database analysis demo would just rm -rf itself if you asked despite them spending 30 minutes lecturing about guardrails. you could also just ask it to insert data into the queries freely, despite it supposedly being limited to the defined schema. half baked at best