Scope is the safety control
A copilot should retrieve only from sources a role is allowed to see, and it should name those sources in the draft. If it cannot name a source, it should say it does not know.
The draft is not the decision. A person accepts, edits, or rejects it before anything is filed or sent.
What we instrument
Time until a reviewable draft exists, and whether the person keeps it, edits it, or throws it out. Those two signals tell you if the copilot is useful.
They do not tell you, in advance, how much time you will save.