AI Agent Governance for Law Firms and Legal Departments
Legal organizations face unique constraints: attorney-client privilege, ethical walls, conflict screening, and bar association opinions on AI use. An agent that reviews documents, drafts contracts, or assists with due diligence must operate within strict, provable boundaries.
What Goes Wrong Without Controls
A large law firm deploys agents to accelerate M&A due diligence, contract extraction, and regulatory filing review. Within one engagement:
- A due diligence agent processing target company documents accidentally accesses a privileged memo from a concurrent matter — the ethical wall was not enforced at the agent layer
- A contract extraction agent sends full agreement text to a model API, including counterparty trade secrets covered by NDA — no DLP redaction was in place
- Opposing counsel challenges the accuracy of an AI-assisted document review — the firm cannot prove which documents the agent reviewed or what extraction logic it applied
Regulatory and Ethical Mapping
| Requirement | Source | Claw EA Control |
|---|---|---|
| Attorney-client privilege | ABA Model Rules, state bar rules | File path scopes restrict document access; DLP redaction strips privilege markers |
| Ethical walls / conflict screening | ABA Model Rule 1.6, 1.10 | Scoped tokens enforce matter-level boundaries; agents cannot cross walls |
| Supervisory responsibility | ABA Model Rule 5.3 | Two-person rule ensures human review before deliverables; proof bundle enables audit replay |
| Data security | ABA Formal Opinion 477R | Egress allowlist, secret boundary, encrypted transit |
Recommended Control Stack
DLP Redaction
Strip privileged content, PII, and counterparty trade secrets before prompts reach any model provider.
Two-Person Rule
Require attorney review before AI-assisted work products are delivered. Signed receipt proves review occurred.
Scoped Tokens
Matter-level access boundaries. Each agent token restricts access to documents within its authorized matter.
Audit Replay
Replay the agent's document review step-by-step. Proves what was reviewed, what was extracted, and what was missed.