Groove Copilot
Groove Copilot is an approval-first assistant in the app editor (and greenfield mode on the applications home). It can inspect the current app, explain behavior, propose structured changes, and apply approved changes through the same editor paths a person uses.
Copilot never silently writes to your app. Proposals appear in chat; you Approve or Reject before anything applies.
What it can propose
| Tier | Examples |
|---|---|
| READ | Inspect app, page, selection, datasource schema |
| WRITE | Add/update widgets, create pages/queries/JS Objects, update actions, create application (greenfield) |
| EXECUTE | Test datasource, run a query (requires per-action approval) |
| DESTRUCTIVE | Delete widget (requires per-action approval) |
Copilot is prompted with Groove Builder layout rules (64-column grid, layout.rootCanvasId), common widget types (including Table, Form, Custom, Iframe), and binding/query/JS recipes so proposals use real editor tools instead of pasted code. Inspect tools (inspect_application, inspect_page, inspect_selection) do not change the canvas — asks to improve visuals or @-mentioned widgets require WRITE proposals such as update_widget_properties.
Trust model
- Model output is untrusted until validated and approved.
- Provider API keys are encrypted server-side (BYOK) and never added to builder context.
- Server ACL still authorizes every apply.
- Secrets in context are redacted.
Related: App User Agent
For published app end users (not builders), see App User Agent — a separate confirm-before-act assistant configured per application.