Co-pilot the decision

Grocery purchase for the week's meal plan costs real money. The Meal Companion may assemble a list, compare prices, and recommend a bundle. It should not auto-buy because the model is confident. That boundary is co-pilot the decision: the system prepares, compares, and challenges within granted authority, while the household retains ownership where values, irreversibility, or unsettled terrain require it. Microsoft popularised co-pilot language across the industry. This note reclaims it with precision: decision ownership front and center, not autocomplete branding.

Helpful context: Sharing judgment and human judgment that should remain define where people must lead. Collaboration contract turns allocation into experience.

What co-piloting looks like across decisions

Different decisions require different distributions of work between person and system. Weekly meal plan decisions call for the system to propose a plan, show assumptions, and offer local patch options, while avoiding silent final plan delivery without inspectable grounds. Grocery purchase calls for the system to assemble a list with cost breakdown and an approval button, while avoiding auto-charge regardless of model confidence. Unfamiliar medical diet calls for the system to ask targeted questions and defer interpretation to a clinician, while avoiding diagnosis via meal planning rules.

Decision	Co-pilot behaviour	Avoid
Weekly meal plan	Propose plan, show assumptions, local patch	Silent final plan
Grocery purchase	List, cost breakdown, approval button	Auto-charge
Unfamiliar medical diet	Targeted questions, defer interpretation	Diagnose via meal rules

Medical deferral with questions follows the same co-pilot pattern at higher consequence: the system prepares (gathering relevant context, formulating useful questions) while the person retains ownership of the interpretive judgment. The pattern scales across consequence levels by adjusting how much preparation the system does and where the final call sits.

Distribute, do not automate wholesale

The useful question is rarely "automate this decision." It is "which parts belong to the person and which to the intelligence?" The parts include gathering, patterning, generating alternatives, estimating consequence, comparing trade-offs, and owning the final call. Each part can be led by either the person or the system, and the distribution depends on terrain.

When the system prepares, the product surface needs inspectable proposal, evidence, and uncertainty visible. When the person decides, alternatives, freedom to reject, and no forced path. When the system acts within granted scope, clear audit and reversal. These three modes compose across a single decision chain: the system prepares the grocery list (system leads gathering), the household reviews and approves (person leads final call), and the system executes the purchase within the approved scope (system acts with audit).

The objective is to distribute the decision intelligently across person and system.

Thoughtware: Designing in the Intelligence Age · Ch. 16

Terrain decides the split

Familiar, low-consequence, reversible planning can lean toward machine preparation with lighter human review. Novel, high-consequence, irreversible, or value-laden work leans toward human ownership with heavier system preparation of materials and alternatives. The Judgment Leadership Curve makes that allocation explicit along a chain. When allocation and surface disagree, people experience either abdication (the system decided without me) or ceremony (I am rubber-stamping something I cannot meaningfully review).

The process for getting the split right starts with mapping the Judgment Chain for the decision in question: what steps compose it, and who leads each step. Then assign leadership per link using terrain and consequence as the criteria. Design the Collaboration Contract for each allocation so the surface matches the declared mode. Verify that the product surface actually provides the information and controls that the allocation promises. Mismatches between declared allocation and actual surface produce passive acceptance theatre.

The grocery co-pilot walkthrough

The Meal Companion assembles a shopping list from accepted meals, estimates cost, flags items that hit allergy or budget constraints, and presents "approve purchase" with the total and any flagged items visible. The household may reject, edit quantities, or defer. Deterministic code records approval and audit trail. No charge runs without explicit grant.

That flow distributes gathering and estimation to the system and ownership of spend to the household. Each link has a named owner: system owns gather through flag, household owns approve, system owns execute within granted scope after approval. Skipping approval breaks co-pilot into auto-act, which violates the collaboration contract regardless of whether the system's choice would have been correct.

Co-pilot versus full delegation

Full delegation assigns an outcome and walks away. The household says "handle grocery shopping" and the system buys whatever it determines is needed. Co-pilot keeps the person in the loop at ownership points. The Meal Companion may delegate meal suggestion (system proposes, person reviews casually) while co-piloting purchase (system prepares, person explicitly approves) and deferring medical diet interpretation entirely (system asks questions, person consults clinician).

Products that co-pilot in marketing and delegate in defaults train passive acceptance: the household believes they own the decision but the surface provides no meaningful rejection path. Products that require approval for everything train form fatigue: the household clicks approve reflexively because every decision demands attention regardless of consequence. Terrain and contract must align so that high-consequence decisions get real approval and low-consequence decisions get appropriate trust.

Marketing language versus product truth

Products marketed as "co-pilot" should document final call ownership, visible alternatives, and reject paths for each feature that carries the label. Auto-apply defaults hidden behind confident summaries violate the co-pilot pattern even when the label says co-pilot, because the person cannot meaningfully reject what they cannot see. Households experience co-pilot as prep plus choice. Enterprises experience it as audit plus approval. Both need surfaces that match allocation.

A marketing copy audit lists every co-pilot claim and verifies final call owner, alternatives shown, reject path, and audit trail for each. Gaps between marketing and product surface represent trust debt that compounds when households discover the mismatch. Procurement teams increasingly ask these questions, and marketing ahead of allocation produces abdication incidents when buyers discover that "co-pilot" meant "auto-decide with undo buried in settings."

Reject paths must be real

Co-pilot requires working reject without penalty. Reject grocery bundle should return to edit list, not guilt copy or hidden default re-apply. A reject path that leads to a dead end or that silently re-applies the rejected option is ceremony, not collaboration. The system continues after reject with revised preparation: "You rejected the bundle. Here is the list for editing. Let me know when you are ready for a new estimate."

Value-laden decisions stay human regardless of model confidence. Ethical trade-offs, medical interpretation, and spend beyond granted limits require person-led final calls. The system prepares comparison and materials. The person owns the judgment. Products that auto-decide value-laden work invite relational and legal failure because the consequence attaches to the person even when the system chose.

Gradual authority and explicit grant

Households may grant expanded authority over time. After ten manual grocery approvals, the household might grant auto-approve under twenty dollars. That gradual grant is documented in settings with a revoke path. Co-pilot can evolve with explicit consent rather than silent drift. Partial automation (auto-apply pantry staples under five dollars while co-piloting total purchase) requires explicit grant per threshold, disclosed in the surface so the household knows what is automated and what awaits their approval.

Enterprise approval chains extend the same pattern with multiple human links. Manager approval on spend above a threshold means the system prepares, multiple humans decide at each gate, and the system acts only after all gates pass. The architectural pattern is the same at household and enterprise scale: named ownership at each link, visible alternatives, working reject paths, and audit trails for system acts.

Common failures

Abdication dressed as assistance: the system decides and presents the result as if the person chose. Ceremony that shows alternatives but auto-applies defaults regardless of person input. Allocation and surface mismatch where marketing says co-pilot but the product provides no meaningful reject path. Silent auto-apply after reject where the system interprets rejection as confusion and re-applies the original choice. Co-pilot labels on features where the person has no visibility into what the system prepared or how to challenge it.

These failures share a root: using "co-pilot" as a marketing positioning rather than as an architectural commitment to distributed decision ownership. The correction is structural: allocation sheets document the split before launch, reject paths receive the same test rigor as happy paths, and legal reviews final-call ownership text for medical, financial, and purchase flows before co-pilot labels ship.

What to do next

The test for co-pilot honesty is a single decision the product currently markets as co-pilot. Document who owns the final call, what alternatives are shown, and what happens on reject. If alternatives are invisible, if reject leads to a dead end, or if the system silently re-applies after rejection, the co-pilot label exceeds the product truth. Fix the gap by adding visible alternatives, working reject paths, and audit trails that make ownership explicit in the surface rather than in the marketing copy alone.

See language over layout and sharing judgment.

Read next: Beyond the interface.