Merchandising Copilot security and governance

This is for:

Developer

The Merchandising Copilot helps you move from business intent to insight or action faster, while keeping the controls you already rely on in the Coveo Merchandising Hub (CMH). This article explains the security and governance model behind the Merchandising Copilot so that merchandisers, implementers, and the teams that support them understand how it’s designed to assist your work without taking control away from you.

At its core, the Merchandising Copilot is a human-in-the-loop assistant, not an autonomous operator. It can interpret your intent, retrieve context, surface insights, and prepare supported actions, but you remain responsible for reviewing and confirming anything that affects your storefront.

Note

The Merchandising Copilot can make mistakes. Always review and verify any suggestion before you apply it or use it to make decisions.

What "secure and governed" means for the Merchandising Copilot

The Merchandising Copilot operates inside the Coveo Merchandising Hub (CMH) rather than as a separate, general-purpose AI tool. Because it’s embedded in CMH, it works within the same boundaries and governance patterns as the rest of your merchandising workspace.

A few principles shape the experience:

  • It assists with interpreting intent, retrieving context, and preparing actions, but it doesn’t act on its own.

  • Storefront-impacting changes are prepared as proposals and applied only after you confirm them.

  • Supported actions are scoped, and requests that are considered unsafe, unsupported, or out-of-scope aren’t executed.

  • Responses draw on trusted context from the CMH rather than free-form guesses.

  • Merchandising Copilot-assisted activity stays traceable.

Each of these principles is covered in more detail in the sections that follow.

Human control and confirmation

The Merchandising Copilot is designed to help you prepare and understand work, not to act on its own. When you describe a goal in natural language, the Merchandising Copilot interprets your intent and, where applicable, prepares a proposed change for you to review.

Nothing that affects your storefront is applied until you review the proposal and confirm it. You remain the gatekeeper: if a proposed result doesn’t match your intent, you can refine it before anything changes, or decline it.

Action risk model

Not all requests carry the same level of risk, so the Merchandising Copilot treats them differently. Actions fall into three general categories.

Category What it covers How it’s governed

Read-only

Retrieving information, such as configurations, catalog fields, and metrics shown in the CMH.

Runs without modifying any configuration.

Write

Changes that affect configuration, such as creating or updating ranking rules and recommendation strategies, or adjusting facet settings.

Prepared as a proposal and applied only after you review and confirm it.

Restricted or high-risk

Actions that could create unacceptable operational risk if applied through an assistant.

Limited or excluded from the Merchandising Copilot’s scope.

This model lets the Merchandising Copilot move faster on low-risk requests while keeping a clear, deliberate step between a proposed change and a confirmed one. If a request falls outside the supported action set, the Merchandising Copilot won’t generate a proposal for that action. It can also explain why the action isn’t available, so you know to handle it manually in the CMH.

Grounded, contextual responses

The Merchandising Copilot is designed to ground its responses in relevant, trusted context from the CMH and supported Coveo systems, rather than treating its output as free-form guesses. When it surfaces an insight or prepares an action, it draws on the configurations, catalog information, and metrics available in your merchandising workspace.

You should still review what the Merchandising Copilot returns. Grounding improves the relevance and reliability of responses, but it doesn’t remove the need for you to validate important recommendations before you rely on them.

Traceability and auditing

Merchandising Copilot-assisted activity is designed to stay observable, so that work done with the Merchandising Copilot’s help remains transparent. Where applicable, you can identify entities that were created with the Merchandising Copilot or that the Merchandising Copilot was involved in, which helps you review, trace, and clean up changes through standard CMH workflows.

This traceability supports accountability: you can see where the Merchandising Copilot contributed and confirm that the outcome matches your intent.

Your responsibilities when reviewing Merchandising Copilot output

The Merchandising Copilot can accelerate your workflows, but you stay in control of the results. To get the most value while keeping your storefront safe:

  • Review outputs before you rely on them, and validate important recommendations against what you know about your business.

  • Confirm an action only when the proposed result matches your intent.

  • Treat the Merchandising Copilot as an assistant for supported, well-scoped workflows, and expand your use as your confidence grows.

What’s next