AI Agents in Legal Work Guide: Protecting Privilege, Matters and Court Filings

Legal teams are moving from chat assistants to AI agents that search the document management system, review contracts, run eDiscovery and draft filings, and each step widens what a single compromised or mistaken agent can expose. Legal work adds risks other functions do not carry: client confidentiality backed by professional rules, legal professional privilege that can be lost, ethical walls between matters, and personal accountability to the court for every citation. This guide covers the agent layer in law firms and in-house legal teams: where agents are used, how to give them identities that respect matter boundaries, untrusted input from counterparties and opponents, verification of legal output, what regulators and courts now expect, and how to monitor and roll out. It is written for legal operations and technology leads, firm security and IAM teams, general counsel and risk partners. Firm-wide security controls are in the Cybersecurity for Legal Firms Guide; this guide goes deeper on agents.

Source note: legal and regulatory points on this page summarise the cited official texts and secondary analyses, with status checked on 11 November 2026. Confirm against the official text before relying on it.

Key takeaways

• The matter is the security boundary. An agent must inherit the same matter access and ethical walls as the lawyer it works for, enforced in the document system, not in the prompt.
• Counterparty documents are untrusted input. Contracts, disclosure sets and opponent correspondence can carry hidden instructions aimed at review and drafting agents.
• Accountability does not move to the agent. The SRA's August 2026 warning notice says using AI does not reduce or transfer professional responsibility, and the High Court in Ayinde held every representative responsible for what they put before the court.
• Privilege and confidentiality depend on the tool's terms and set-up. The SRA warns that privilege may be permanently waived when client information goes into unsuitable tools; contract terms, retention and training restrictions are security controls.
• Verify before anything leaves the firm. Agent-drafted filings, advice and correspondence need a named lawyer who checks authorities and facts against primary sources.

Where AI agents appear in legal work

Identity and matter-level access

Most firms already run need-to-know security on the DMS, with ethical walls for conflicts and lateral hires. Agents break this model when they use a service account with firm-wide read access or an index built across all workspaces.

• Act as the lawyer, not as the firm: research and drafting assistants should query the DMS with the signed-in user's permissions so walls apply automatically. Avoid central indexes that copy content outside the DMS security model unless they enforce the same access control lists at query time.
• Dedicated identities for autonomous agents: an eDiscovery or intake agent processing many matters needs its own non-human identity, scoped to the matters or workspaces assigned, with an owner in legal operations and one in security.
• Carry walls into collaboration tools: if agents read Teams or SharePoint, apply the same separation there. Microsoft Purview information barriers, for example, list ethical walls between lawyers representing different clients as a supported scenario for Teams, SharePoint and OneDrive (not email).
• Time-box matter access: grant agent access to a matter for the life of the task and remove it at matter closure, the same as for a contract lawyer.
• Short-lived credentials: use OAuth or workload identity integrations with the DMS, CLM and research platforms rather than stored API keys; record each in the NHI inventory. See the Law Firm Identity and Data Security Guide and AI Agent Authorisation Guide.

Untrusted input in legal workflows

Lawyers spend their days reading documents written by people whose interests oppose their client's. An agent that reads those documents and can also act (send, redline, tag, search other matters) is exposed to indirect prompt injection.

The EchoLeak case showed how an inbound email could make an enterprise assistant leak internal data, which is the pattern a matter-aware agent must be designed against. See the Prompt Injection Guide.

Confidentiality, privilege and vendor terms

The SRA warning notice on the misuse of AI (published 17 August 2026) says public AI tools may put client information into the public domain and that privilege may be permanently waived. It says client data should be entered only where appropriate contractual, technical and organisational safeguards are in place, including checks that data is not used for training without authorisation and not kept longer than necessary. In the US, ABA Formal Opinion 512 (29 July 2024) applies the Model Rules on competence (1.1), communication (1.4), fees (1.5) and confidentiality (1.6) to generative AI.

• Contract terms: no training on firm or client data, defined retention for prompts, outputs and logs, data location, sub-processor list, breach notification and audit rights. See the AI Contract Clauses Guide.
• Client terms: outside counsel guidelines increasingly restrict AI use; record per client whether agents may process their matters.
• Platform security around the AI: the McKinsey Lilli case involved unauthenticated APIs on an internal AI platform holding confidential conversations; test the application and its APIs, not only the model.
• Logs are client data: prompts, retrieved passages and outputs contain privileged material; restrict access, apply matter retention and include them in legal hold. See the eDiscovery and Legal Hold Guide.

Verification and court filings

In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank ([2025] EWHC 1383 (Admin), 6 June 2025), the Divisional Court dealt with filings containing authorities that did not exist: five in Ayinde, and 18 of 45 in Al-Haroun. The court said lawyers using AI for research must check output against authoritative sources, that heads of chambers and managing partners must ensure practitioners understand their duties, and that referral to a regulator is likely to be appropriate when false citations reach a court. The SRA notice adds that relying on an AI output is not a defence.

1. Check every authority in an agent-drafted document against an official or subscription reporter, including that it says what it is cited for.
2. Record who verified each filing and when, in the matter file.
3. Block autonomous filing: no agent should submit to a court portal or serve documents.
4. Check local court rules on AI disclosure before filing; rules vary by court and change often.

See the AI Hallucination Business Risk Guide.

In-house legal teams: what changes

In-house teams face the same duties with a different estate. Agents often sit in business platforms rather than legal ones, and the people asking questions are colleagues, not clients.

• Business tools, legal content: the SRA notice warns in-house lawyers to take particular care because tools built for the wider business may not suit legal work. A company-wide assistant indexing the legal team's SharePoint can surface draft advice, investigation files or litigation strategy to any employee whose permissions were set loosely.
• Privileged output reaching non-lawyers: an in-house legal service agent that answers business users can spread advice beyond the people who need it, weakening privilege claims. Label agent answers that draw on privileged material and restrict who can receive them.
• Contract repositories as a data source: CLM agents that answer "what are our obligations to supplier X" read every contract in scope; restrict by business unit and confidentiality level, and keep board, M&A and employment matters out of general indexes.
• Investigations and whistleblowing: keep investigation workspaces out of any agent's reach unless the investigation team owns that agent.

The rule of thumb is the same as for firms: the agent's access is the union of everything it can read, so map that union before switching it on. See the Enterprise AI Copilot Security Guide.

Decision guidance: how much autonomy to allow

Small versus large organisations: a small practice should use one approved tool under enterprise terms, keep it out of client data until terms are checked, and verify everything manually. A large firm or legal department needs matter-aware integration with the DMS, a governance group covering risk, IT, security and knowledge management, client-level AI permissions and a test programme for injection and wall bypass.

How to implement

1. Inventory: list AI features and agents in the DMS, CLM, review platform, research services and collaboration tools, with identity, matters reached and actions.
2. Confirm access inheritance: test that an agent acting for a walled-off lawyer cannot retrieve the walled matter, by search, summary or citation.
3. Set terms: complete vendor due diligence and record client permissions before any client data is processed.
4. Pilot on closed or internal matters: compare agent output with lawyer work, and seed test documents with hidden instructions.
5. Enable by practice group: start with read-only tasks; add outbound actions only with per-message approval.
6. Roll back: disabling the agent identity must not affect DMS access for lawyers; keep the manual workflow documented.
7. Train and supervise: include verification duties and the SRA or bar guidance in onboarding; supervisors remain accountable for agent-assisted work.

Detection and measurement

Log agent queries and actions with agent identity, acting lawyer, client and matter number, documents retrieved, tools used and approver. Alert on:

• agent retrieval from a matter behind an ethical wall for the acting user;
• retrieval across an unusual number of clients or matters in one session;
• outbound messages or uploads containing documents from a different matter than the thread;
• documents flagged for hidden text in incoming counterparty or disclosure sets;
• new AI features enabled in legal platforms.

Metrics: percentage of agents with matter-inherited access; wall-bypass test results per release; percentage of filings with a recorded verifier; number of citation errors caught before filing; time to remove agent access at matter closure; number of clients with recorded AI permissions.

Framework mapping

Common failure patterns

• Firm-wide index: a vector store built across all workspaces with one service account, so ethical walls disappear for the agent.
• Prompt-based walls: instructing the model not to use other matters instead of enforcing access in the DMS.
• Unverified authorities: drafts filed with citations nobody checked, as in Ayinde and Al-Haroun.
• Consumer tools for client work: fee earners using personal AI accounts because the approved tool is slow or limited.
• Logs outside legal hold: agent prompts and outputs deleted on a vendor's schedule while the matter is under hold.
• Agents left on closed matters: access granted for a deal never removed.

Practitioner checklist

• Inventory every AI agent and feature in legal platforms with identity, matters and actions.
• Make agents inherit the acting lawyer's DMS permissions and ethical walls; test it.
• Give autonomous agents dedicated, matter-scoped identities with named owners.
• Treat counterparty, disclosure and opponent content as untrusted and remove outbound tools from review agents.
• Agree no-training, retention and location terms before client data is processed.
• Record client permissions for AI use per client.
• Require a named verifier for every filing and external document an agent drafts.
• Bring agent logs under matter retention and legal hold.
• Remove agent access at matter closure and re-test walls after each release.

Standards and references

• Solicitors Regulation Authority: Warning notice on the misuse of AI
• The National Archives: Ayinde v London Borough of Haringey [2025] EWHC 1383 (Admin)
• American Bar Association: ABA issues first ethics guidance on AI tools (Formal Opinion 512)
• OWASP: LLM01:2025 Prompt Injection
• OWASP GenAI Security Project: Top 10 for Agentic Applications for 2026
• Microsoft Learn: Information barriers
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Law Firm Identity and Data Security Guide · Legal Privilege in Incident Response Guide · Human-in-the-Loop for AI Agents Guide · Agentic AI Identity Guide · AI Agents in HR Guide