The correct answer is B . Microsoft’s SSMS Copilot documentation states that queries from Copilot in SSMS are executed under the context of the user’s login and permissions , and that there are no separate permissions for Copilot in SSMS . That means Copilot-run Transact-SQL cannot access more data than the developer’s own database principal is already allowed to access.

That is why the other options are incorrect:

A is wrong because Copilot does not use a separate read-only sandbox in place of database permissions.

C is wrong because enforcement is not a client-side filtering trick; it is enforced by the database security context of the current login.

D is wrong because Copilot does not apply a different RLS model from the developer; it simply runs under the same login context.

So the security boundary is the developer’s existing database identity and permissions .