RevenuePilotby Foxes TechnologyRevenue Copilot is the conversational layer over your workspace. It reads the same approved evidence the engine used, explains it in plain language, and stops exactly where policy begins—it cannot change a price, edit a guardrail or trigger a write.
Copilot exists for the moment between reading a recommendation and deciding what to do about it. Everything it answers is drawn from evidence already approved in your workspace.
Open the receipt behind a recommendation and walk through it in conversation—the source snapshot, the economics used and the boundary that applied.
Ask why one move ranks above another and get the ranking rationale rather than a restatement of the queue order.
Understand what the confidence score is made of, which inputs are thin, and why a signal was withheld instead of shown with false precision.
Ask which guardrail blocked a proposal—confidence floor, movement cap, cooldown, floor or ceiling—and what would have to change for it to become eligible.
Ask about margin, occupancy and pace across the products and departures in scope, without exporting to a spreadsheet first.
Turn a decision and its receipt into a note a colleague or an owner can read—drafted by the model, approved by you.
The clearest way to understand Copilot is to see what it is not permitted to touch. The same capability read across three columns tells the whole story.
| Capability | Revenue Copilot | Deterministic engine | Execution plane |
|---|---|---|---|
| Produce a recommendation | No | Yes | No |
| Explain a recommendation | Yes | Records the receipt | No |
| Apply guardrails | Reads them | Enforces them | Re-checks them |
| Change a guardrail or policy | No | No — policy is configuration | No |
| Change a price | No | Proposes only | Yes, when gated and approved |
| Trigger any write | No | No | Yes, one route only |
| Draft an operator note | Yes | No | No |
A conversational surface over revenue data is only useful if it is grounded, bounded and honest when something is missing.
Copilot answers from the reconciled evidence already present in your workspace—the same snapshots, economics and receipts the engine used. It does not invent numbers, and where the evidence does not support an answer it says so instead of filling the gap.
Every response is produced as a structured, schema-validated object—evidence, actions and warnings are separate fields rather than prose the interface has to parse. A response that fails validation is rejected rather than rendered.
An in-repo evaluation set covers prompt-injection resistance, grounding and no-hallucination behavior, and refusal of execution requests. It runs in continuous integration, so a regression in any of those properties is a build signal rather than something a customer discovers.
Thumbs and comments on an answer are persisted append-only and aggregated so quality is measured rather than assumed. Exported organization data excludes feedback free text by allowlist, so a rating never carries prose into an export.
The failure modes matter more than the happy path. Copilot is built to be cleanly unavailable rather than quietly wrong.
Where a provider key is absent the surface is cleanly unavailable rather than presenting a degraded answer as a real one. Offline, timeout and retry states are designed rather than incidental, and a retry does not duplicate the turn that failed.
Conversation history is tenant-local, and the evidence Copilot can read is bounded by the same tenant scope as the rest of the product—data is tenant-scoped behind forced PostgreSQL row-level security. There is no cross-workspace memory and no shared conversation store.
Keyboard and focus management, unread state and full-screen behavior on mobile are part of the surface rather than afterthoughts, because a revenue review often happens between other things.
No. Copilot cannot bypass a guardrail, change a price, alter policy or trigger any write. The execution path does not accept model output as a signal, so the capability is absent from the architecture rather than withheld by instruction.
From approved evidence already in your workspace—the reconciled source snapshot, the economics and the receipt attached to a recommendation. It does not invent numbers, and it states when the evidence does not support an answer.
An in-repo evaluation set runs in continuous integration covering prompt-injection resistance, grounding and no-hallucination behavior, and refusal of execution requests. A regression in any of those properties fails the build.
Conversation history is tenant-local to your workspace and bounded by the same row-level security as the rest of your data. Feedback is stored append-only, and exported organization data excludes feedback free text.
Copilot is available inside the workspace alongside the queue and the receipts. Reading it changes nothing, which is the point.