Dollie Editor SDK
Playground

Dollie Editor SDK guide

Secure the Copilot and Control Cost

Limit what the Copilot can access and send only the information needed for the current request

Dollie Editor checks page suggestions, but your application still controls access to users, customers, pages, and data.

Treat every Copilot request like any other request to your server.

Check access before calling AI

Before building a prompt or running a tool, your server should:

  1. identify the signed-in user;
  2. find the customer or team from the request;
  3. check that the user may edit the page;
  4. load only the Catalog and data allowed for that page.

Do not let the model choose a customer id, page id, or permission.

Check every suggestion

AI output is external input. Validate it before it reaches the editor or database.

Check that:

  • every component exists in the current Catalog—the list of components allowed in this editor;
  • every prop matches a registered field;
  • images, illustrations, and widgets use allowed values;
  • the target section still exists;
  • the current user is still allowed to make the change.

The default proposal tools and result cards handle the Catalog and section checks. Your server still handles user access and saving.

Keep publishing separate

A Copilot suggestion is not a published change.

Use separate steps for:

  1. generating a suggestion;
  2. applying it in the editor;
  3. saving the draft;
  4. publishing the page.

This gives people a clear chance to review the result and keeps your existing publishing permissions in place.

Send less information

For a change to one heading, send the selected section instead of the whole page.

When the Copilot needs a component, first send a short list of available components. Fetch the full field details only for the components it plans to use.

Do not send unrelated pages, private records, secrets, or full database objects.

Less context usually means:

  • lower model cost;
  • faster responses;
  • fewer irrelevant suggestions;
  • less private data leaving your application.

Use a suitable model for each job

Rewriting one field may need a smaller model than planning a complete page.

Dollie Editor does not choose the AI provider or model. Your application can choose a different model for each fill or Copilot request.

Judge the result by whether it is useful, valid, and easy to review.

Make the current state clear

The interface should clearly show whether a suggestion is:

  • waiting for review;
  • applied to the editor;
  • saved as a draft;
  • published.

The Copilot should never say that it saved or published a page when it only returned a suggestion.