Copilot is brokered through RadioPad policy gates. Tokens never enter browser state, localStorage, or IPC payloads.