Promptbook node maps
Copilot for Security, Microsoft
Reimagining the current linear experience of running a chain of prompts into a multi-path node builder.
A chain of prompts
Most AI tools stop at a single prompt and response.
Promptbooks go a step further, chaining prompts together so results can stack and evolve. I designed a new node builder experience that reimagined Promptbooks beyond linear sequences—introducing branching, conditions, and powerful new ways to explore complex workflows.
PROCESS SUMMARY
Over the course of two months in Spring 2025, I acted as the primary designer, driving the redesign of an existing experience to make it more flexible and impactful. I led design from discovery through to handoff, balancing user needs, technical constraints, and design system guidelines.
TEAM
Manager — Hayley Steplyk
Product Designers — Amelia Koster
Product Manager — Namrata Puri
FINAL MVP
From linear flows to living maps
I reimagined Promptbooks as a flexible, node-based builder that supports branching, conditions, and direct system capabilities—transforming what was once a linear workflow into an interactive map.
Users can now create Promptbooks from scratch, test prompts individually or as a full sequence, and scope prompts to system skills for greater precision. The builder introduces a clean workspace with collapsible details, intuitive node cards, and a testing flow that helps analysts validate their work while saving compute resources. In user testing, satisfaction with the Promptbook experience jumped from 25% to 95%, with participants noting the design felt familiar to workflow tools like LogicApps while being tailored to their security use cases.
BACKGROUND
Meet baseline Copilot
Security Copilot is Microsoft’s AI-powered assistant for cybersecurity analysts. It combines the power of large language models with an organization’s security knowledge, helping analysts investigate threats, summarize alerts, and automate routine workflows.
While powerful, many tasks required chaining multiple prompts together. Analysts needed a more scalable way to automate these investigations without constantly monitoring sessions.
When promptbooks weren't enough
The original Promptbook experience let analysts save a sequence of prompts from a session. While useful, it was limited: analysts couldn’t create promptbooks from scratch, test them efficiently, or design branching logic for complex investigations.​
The challenge was clear: Promptbooks needed to evolve from a simple recorder into a powerful builder.
CUSTOMER FEEDBACK
Feedback from surveys and interviews revealed low satisfaction—only 25%—with users asking for features like conditional flows, parallel paths, and tighter integration with system capabilities.
Simply designing for complexity
My role was to translate these evolving needs into a clear, intuitive experience.
I focused on four key challenges: creating promptbooks from scratch, supporting branching and conditions, enabling prompt testing, and integrating direct system capabilities. Through iterative design sprints and feedback sessions with PMs, researchers, and customers, I shaped a vision for the new builder experience.
The challenge
How might we reinvent the promptbook experience to fit growing customer needs?
The solution
PROCESS
Existing experience
The original Promptbook experience allowed analysts to capture a sequence of prompts from a live session and replay them later. After running a set of prompts, users could select them in the session window, package them into a promptbook, and adjust basic details like inputs and permissions.​
While this workflow was straightforward and met early customer needs, it was limited to recreating what had already been run. Users couldn’t start from scratch, test prompts efficiently, or introduce branching and conditions—leaving power users constrained when trying to build more complex workflows.
Building the builder
To reimagine the Promptbook experience, I focused on four core pillars shaped by user research and customer feedback. Each pillar represented a gap in the existing workflow and guided the design of the new builder experience.
1. New entry point
To support users who wanted to create Promptbooks from scratch, I introduced a new entry point on the Promptbooks page itself, complementing the existing session-based creation flow. This allowed analysts to start fresh without relying on a previously run session.​
I mapped the product’s information architecture, considering the natural pivot points of Home and My Sessions, and determined that the Promptbooks page was the most intuitive place to surface this functionality. This design gave users more control, flexibility, and a clear path to building workflows tailored to their specific needs.
BUILDER LAYOUT
This new ‘build from scratch’ option required a redesigned interface to support flexible workflow creation.
I organized the builder into a three-panel layout: the left panel houses promptbook details, permissions, and plugins; the central panel serves as the main workspace where users can add and arrange nodes freely; and the right panel opens temporarily to edit content within individual nodes, keeping the workspace uncluttered while allowing detailed customization.
Promptbooks page
Promptbook create - empty
2. Branching paths
To address the need for more complex workflows, I introduced branching functionality into the Promptbook builder.
Conditional branching allows users to direct the flow based on specific criteria, supporting if/else and for each logic for the MVP. Parallel branching enables multiple paths to run simultaneously, giving analysts the flexibility to execute different sequences without losing context.
NODE CARDS
I iterated on node card design to clearly distinguish between regular prompts, system capabilities, and condition cards, while thinking about intuitive controls for adding, deleting, and managing branches. This approach ensures that even complex workflows remain readable and manageable.
Generate incident summaries for risky incidents
Classifying phishing emails
3. Testing and validation
To help analysts ensure their Promptbooks worked as intended, I designed testing functionality at both the individual prompt and full-Promptbook level. Users can run a single prompt to validate its output, or execute the entire workflow to see how all nodes interact in sequence.
The testing interface includes a split-screen view that highlights the node currently in progress while showing the surrounding context, giving users clear feedback on each step. This feature not only improves confidence in results but also helps analysts save compute resources by catching issues early.
Testing an individual prompt
Testing an entire promptbook
4. Scoping to a system capability
Analysts often needed to scope their prompts to trusted system skills for more reliable and precise results.
To support this, I designed the builder to integrate system capabilities directly into the node map. Users can attach a system skill—such as AnalyzeIncidentForSeverity—at the node level, ensuring prompts run with the right context and authority. This reduces ambiguity in outputs, strengthens trust in the workflow, and makes it easier for analysts to operationalize their expertise without manually configuring each step.
Adding a system capability
The prototype
Now let's put the pieces together...
VISUALS + VALIDATION
Extending the system, thoughtfully
Because this project introduced new interaction patterns, I worked closely with the Security Fluent Extension (SFE) design systems team to extend existing components.
I created guidance for node cards, adapting patterns from Fluent while balancing usability, clarity, and visual consistency. For features like prompt testing, I adapted existing components instead of reinventing, ensuring alignment with the broader Microsoft Security design ecosystem.
The 95% moment
After the initial design was in place, I ran a second round of testing with security analysts to validate the new builder experience. This round focused on how well users could navigate branching paths, test prompts efficiently, and apply system capabilities within their workflows.
Feedback showed that the node-based builder not only felt familiar—reminding many of existing workflow tools like LogicApps—but also tailored specifically to their needs in security investigations. Most importantly, satisfaction with the Promptbook experience jumped from 25% to 95%, with analysts highlighting the clarity of the node map, the flexibility of the branching logic, and the ease of testing as key improvements.
TAKEAWAYS
Key insights
This project was one of the most rewarding I’ve worked on because it allowed me to explore and define a new product direction while balancing system constraints.
I learned how to stay flexible in the face of evolving requirements, distill feedback into a clear vision, and drive alignment across research, PM, and design system stakeholders. Most of all, I saw firsthand how thoughtful design can transform a tool from a utility into something analysts feel confident and excited to use
FLEXBILITY UNLOCKS POWER
By expanding Promptbooks from a linear sequence into a branching, node-based system, I learned how crucial flexibility is for power users. Even small additions like conditional and parallel paths dramatically expanded what analysts could achieve, while still keeping the interface approachable.
TESTING BUILDS CONFIDENCE
Designing ways to test both individual prompts and entire workflows showed me that validation isn’t just a nice-to-have—it’s a trust builder. Analysts valued the ability to catch errors early, conserve compute resources, and approach their investigations with confidence.
FAMILIAR PATTERNS, NEW CONTEXTS
One of the biggest wins came from leaning into interaction patterns analysts already knew, like workflow builders. By adapting these familiar patterns to a security-first context, I reduced the learning curve while still delivering a tool that felt purpose-built for their needs.
Congrats! You made it to the end of this page.
Hope you enjoyed coming along for the ride, and I truly appreciate you taking the time to check out my work! You can reach me at amyzh425@gmail.com — I'd love to chat with you.