Operator Copilots, RAG, and Knowledge Retrieval

Quantum operations teams will use AI assistants to search runbooks, summarize incidents, draft RCA notes, inspect telemetry, and explain platform behavior. This is useful. It is also risky. Operator copilots must not become silent control planes.

NIST AI RMF provides a framework for managing AI system risks [R219]. OWASP’s LLM security work identifies risks such as prompt injection, insecure output handling, sensitive information disclosure, and supply-chain vulnerabilities [R220]. Quantum operator copilots need both risk framing and concrete controls.

Diagram loads as you read

Operator Copilots, RAG, and Knowledge Retrieval · Figure 1

View diagram source

flowchart LR
    Operator[Operator] --> Copilot[Operator copilot]
    Copilot --> Retrieval[Knowledge retrieval]
    Retrieval --> Sources[Runbooks, incidents, docs, evidence]
    Copilot --> Advice[Recommendation]
    Advice --> Human[Human decision]
    Human --> Action[Controlled action]

Copilot boundaries

A copilot can retrieve, summarize, compare, and propose. It should not directly change calibration, submit high-cost jobs, rotate secrets, publish claims, or approve evidence without explicit human action.

Diagram loads as you read

Copilot boundaries · Figure 2

View diagram source

flowchart TB
    Copilot[Copilot capability] --> Read[Read-only retrieval]
    Copilot --> Explain[Explain telemetry]
    Copilot --> Draft[Draft runbook steps]
    Copilot --> Suggest[Suggest next action]
    Copilot -. no direct control .-> Calibrate[Change calibration]
    Copilot -. no direct control .-> Submit[Submit QPU jobs]
    Copilot -. no direct control .-> Approve[Approve claims]

Retrieval architecture

Diagram loads as you read

Retrieval architecture · Figure 3

View diagram source

flowchart LR
    Query[Operator query] --> Classifier[Intent and sensitivity classifier]
    Classifier --> Retriever[Retriever]
    Retriever --> KB[Knowledge base]
    Retriever --> Evidence[Evidence store]
    Retriever --> Incidents[Incident archive]
    Retriever --> Telemetry[Telemetry summaries]
    Retriever --> Context[Grounded context]
    Context --> Model[LLM]
    Model --> Answer[Answer with citations]

The copilot should cite the runbook, evidence package, or incident record used to answer. Unsupported answers should be labeled as suggestions, not facts.

Prompt injection path

Diagram loads as you read

Prompt injection path · Figure 4

View diagram source

flowchart TB
    ExternalDoc[External document] --> Retriever[Retriever]
    Retriever --> Prompt[Prompt context]
    Prompt --> Model[Model]
    Model --> ToolCall[Tool call suggestion]
    ToolCall --> Risk[Prompt injection risk]
    Risk --> Guard[Policy and human approval]

A malicious or stale document may instruct the assistant to ignore policy, disclose secrets, or alter output. The retrieval layer should treat content as data, not authority.

Tool use levels

Level	Capability	Required control
L0	answer questions	citations and disclaimers
L1	draft commands	no execution
L2	execute read-only queries	scoped read token
L3	propose write action	human approval plus policy gate
L4	execute routine write action	narrow automation contract
L5	autonomous remediation	only for pre-approved reversible actions

Diagram loads as you read

Tool use levels · Figure 5

View diagram source

stateDiagram-v2
    [*] --> ReadOnly
    ReadOnly --> DraftAction
    DraftAction --> ProposedWrite
    ProposedWrite --> ApprovedWrite
    ApprovedWrite --> AutomatedRoutine
    AutomatedRoutine --> AutonomousLimited

Most quantum operations copilots should remain at L0 through L3 until the platform has strong evidence, replay, rollback, and audit controls.

Evaluation suite

Diagram loads as you read

Evaluation suite · Figure 6

View diagram source

flowchart LR
    Eval[Copilot evaluation] --> Grounding[Grounding tests]
    Eval --> Safety[Safety tests]
    Eval --> Secrecy[Secret leakage tests]
    Eval --> Action[Action correctness tests]
    Eval --> Drift[Knowledge freshness tests]
    Eval --> Regression[Regression suite]

Evaluation prompts should include stale calibration incidents, ambiguous provider errors, misleading benchmark claims, malicious runbook content, and high-cost job requests.

Human factors

A copilot can increase operator load if it produces confident noise.

Diagram loads as you read

Human factors · Figure 7

View diagram source

flowchart TB
    Alert[Platform alert] --> Copilot[Copilot summary]
    Copilot --> Operator{Operator trusts?}
    Operator -- calibrated trust --> Correct[Appropriate action]
    Operator -- overtrust --> Unsafe[Unsafe action]
    Operator -- distrust --> Ignored[Useful advice ignored]

The goal is calibrated trust. The assistant should expose uncertainty, cite evidence, and preserve the human review path.