How to Use Copilot on ASP.NET Zero Without Inventing Login

ASP.NET Zero Copilot will write you a page. ASP.NET Zero multi-tenancy will decide who is allowed to see the rows. Those are still different jobs. The chat is fast on purpose. Tenancy is slow on purpose. Mixing them is how Tuesday becomes a support thread.

This guide is for license holders and tech leads who just asked Copilot, Cursor, or a similar tool to “add a feature” and felt a little too proud. You will get what ASP.NET Zero 15.2 actually shipped for AI tools, what you still type, a smoke-test table, and when a dedicated development team is cheaper than a leaked tenant.

We do this as a service. You still own the code. Last week’s post was Power Tools. This week is the chat box sitting on the same physics.

Contents

• Key takeaways
• What the new AI skills are for (and are not)
• Multi-tenancy is still a filter
• Path: prompt, then prove Tenant B
• Conflict with “just make it compile”
• Smoke-test checklist
• Frequently Asked Questions
• Conclusion

Key takeaways

• From recent versions, ASP.NET Zero ships AI rules and skills for GitHub Copilot, Cursor, Windsurf, Claude Code, and related tools. Support thread #12636 is the map.
• v15.2 adds AI development rules so the assistant knows Zero architecture. It still does not think about your host-vs-tenant product rule unless you say so.
• Put IMustHaveTenant (or MayHave) on purpose. Do not assume the model guessed isolation.
• Pretty CRUD from a prompt is not the test. Tenant B must fail to see Tenant A’s row.
• Official positioning is blunt: AI writes features. Zero already owns auth, tenancy, and billing. Do not let the model reinvent login.

What the new AI skills are for (and are not)

AI-assisted ASP.NET Zero development is a RAD workflow with a chat. You describe an entity or a feature. The skills try to follow naming, layers, and ABP patterns.

Volosoft’s own AI page says the quiet part: coding tools are fast at unproven auth and tenancy. Zero already has that foundation. Use the assistant for the unique product rule. Do not use it as:

• A substitute for [AbpAuthorize]
• A way to skip tenant filters “so the grid fills”
• A new identity system beside yours

The 15.2 Angular 21 / Mapperly / React UI news is real. It does not change the tenancy physics. Thread #12647 is the other scare: a jump to 15.2 is not a vibe-code weekend.

Multi-tenancy is still a filter

ABP’s data-filter docs are still the law. If you implement IMustHaveTenant, queries pick up TenantId from session. DisableFilter is still a loaded gun.

Last week: Power Tools generated the boring layers. This week: Copilot generates them with more confidence and less shame. Confidence is not a test.

GitHub Copilot ASP.NET Zero prompts that work in one tenant are not done.

Path: prompt, then prove Tenant B

1. Point the AI tool at the repo’s Zero skills/rules (.cursor, copilot-instructions.md, or whatever 15.2 dropped in your tree).
2. Prompt the unique rule, not “build a SaaS.” Example: permissions, tenant interface, no new login.
3. Open the entity. Confirm IMustHaveTenant or IMayHaveTenant matches the product.
4. Confirm the AppService does not disable tenancy filters to please the demo.
5. Log in as Tenant A, create a row. Log in as Tenant B, run the same GET. Empty is success.
6. Try one write as Tenant B against an id from Tenant A. It must fail.

That loop is how you use ASP.NET Zero Copilot for the rest of the product’s life without a silent leak.

Conflict with “just make it compile”

The model will offer a host god user, a shared password, or DisableFilter. Sometimes a report needs a careful using. Wrap it, add your own Where, name the threat in a comment. Do not “fix” an empty grid by turning off tenancy.

File-scoped namespaces and regenerated UI will still fight you on merge days. That is the upgrade post. This week: do not paste a login the model invented.

Smoke-test checklist

Before prompt	After generate	After deploy
Host vs tenant rule written down	Entity interfaces match	Tenant B cannot GET Tenant A
Who may create this entity	Permissions exist	One forbidden write fails
AI skills/rules actually loaded	No invented auth	Logs show the acting tenant

Pretty UI is not the test. A compile is not the test.

Frequently Asked Questions

How do you use ASP.NET Zero Copilot in one sentence?

Load the Zero skills, prompt the tenant rule, then prove Tenant B cannot see Tenant A.

Does Copilot set IMustHaveTenant for me?

Check. Do not assume. Your product rule might be MayHave, host-only, or something uglier.

Can we jump to DisableFilter to speed a demo?

Not in production. A demo that skips the filter trains the leak.

Do we need a dedicated development team?

Not always. Someone who has been burned by ABP filters, plus your people who know the domain, beats a generalist who has never seen a tenant.

Is this the same as Power Tools?

Power Tools is a generator with a form. Copilot is a generator with a chat. Both still need Tenant B.

Conclusion

ASP.NET Zero Copilot is how you stop typing boilerplate. ASP.NET Zero multi-tenancy is how you keep Tuesday from becoming an incident. Prompt. Then log in as the other tenant.

If you want help, that is dedicated-team and framework work we already sell. If you want to do it in-house, paste the smoke-test table into the ticket. Either way, stop treating a confident chat as a reason to skip the filter.