AI agents in legal operations: assistance without invented authority

An agent assembles a chronology, drafts a letter and adds case citations. The document is polished. One authority does not exist, another is from the wrong jurisdiction and the letter makes a concession the client never approved.

The failure is not simply hallucination. The workflow allowed a system to present research, professional judgement and client authority as if they were interchangeable. Legal agents can assist with substantial operational work, but the design has to preserve who is qualified and authorised to make each decision.

Split the workflow into distinct powers

“Draft the response” can hide several activities: retrieve matter documents, summarise facts, research law, choose a position, advise the client, communicate externally and commit to a course of action. Give each a separate control.

Activity	Agent assistance	Required boundary
Matter organisation	classify, deduplicate and build chronology	preserve originals, provenance and privilege controls
Research preparation	formulate queries and collect candidates	verify every authority in an authoritative source
Document review	extract clauses and compare to approved playbook	escalate ambiguity and non-standard terms
Drafting	prepare text from verified inputs	qualified review of facts, law, tone and strategy
Client communication	assemble an approved update	no advice or commitment without authorisation
Filing or signature	prepare a package and checklist	accountable person reviews and submits
Negotiation	summarise positions and draft options	no concession or representation outside mandate

The American Bar Association’s Formal Opinion 512 applies existing duties including competence, confidentiality, communication, supervision, candor and reasonable fees to lawyers’ use of generative AI. Local rules differ, but the operating lesson is broad: technology does not inherit professional authority.

Make source verification unavoidable

An agent should never cite from generated memory. Require a resolvable source from an approved legal research system or authoritative publication, then retain the exact version reviewed.

Verification must ask more than “does this case exist?” Check:

• jurisdiction and court;
• currency and subsequent treatment;
• quoted language against the decision;
• whether the authority supports the precise proposition;
• factual analogy and material distinctions; and
• procedural posture and applicable date.

Use interface friction where it helps: block external drafting until required authorities have been opened and verified by a named reviewer. Test fabricated citations, near-match case names, overruled propositions and correct quotations used for the wrong conclusion.

The Solicitors Regulation Authority’s 2026 warning notice states that regulated professionals remain accountable for their work and highlights incorrect or fake authorities submitted without verification. Accuracy is a workflow control, not a prompt instruction.

Protect matter confidentiality and separation

Map every path by which matter information reaches a model, retrieval store, log, analytics service or support provider. Establish whether the data may be retained, used for training, accessed across borders or disclosed to subcontractors. Apply matter-level access and ethical-wall controls to retrieval as well as file storage.

Use the minimum necessary content. Redact or tokenize identities for tasks that do not require them. Prevent one matter’s context appearing in another session and verify deletion and retention behaviour. A public tool’s familiar interface is not evidence that it is an approved destination for confidential material.

The Courts and Tribunals Judiciary’s AI guidance warns about entering private information into public tools and emphasizes personal responsibility for material produced in a judicial office holder’s name. Legal teams should demand equally clear data and accountability controls from their own agent workflows.

Preserve client and professional authority

Record who authorised the objective, facts, position and external communication. The agent may propose options, but it should not infer consent from an earlier instruction or treat silence as approval.

Hard-block actions such as accepting terms, waiving rights, making admissions, sending privileged material, filing documents and communicating settlement positions unless the exact action has an active mandate and required professional approval. Use short-lived, task-specific credentials rather than a lawyer’s reusable account.

Test boundary pressure: an urgent client request, opposing counsel asking for confirmation, a filing deadline and an ambiguous instruction to “handle it.” The agent should surface the decision and evidence, not invent authority because time is short.

Evaluate the whole work product

Create matter-shaped test cases, not generic legal questions. Provide a controlled document set, known contradictions, jurisdiction, task and permission envelope. Evaluate:

• factual fidelity and provenance;
• completeness and material omission;
• authority validity and application;
• confidentiality and access behaviour;
• recognition of conflict or ambiguity;
• escalation and refusal;
• edit and review burden; and
• final action against the client’s authorisation.

Include adversarial documents that contain instructions aimed at the agent. Matter content is evidence, not system authority. Test whether a clause or email can induce data disclosure or an external tool call.

Design review for judgement, not proofreading

A reviewer needs the source documents, changes, cited authorities, unresolved assumptions and proposed action. A clean final document alone encourages surface review. Make the agent’s evidence map easier to inspect than simply accepting the prose.

Assign review according to consequence and competence. Administrative checking cannot substitute for professional judgement. Measure review time, substantive corrections, missed issues and downstream rework. If the agent increases output volume faster than qualified review capacity, the system may reduce quality despite high task completion.

The Bar Standards Board’s 2026 guidance stresses technology competence, accountability and safe adoption for barristers (BSB). Training should use examples where the agent is fluent but wrong, not only demonstrations of useful output.

Run a matter-shaped boundary exercise

Give the agent a controlled bundle containing duplicate documents, a privileged email, a later factual correction and a purported authority from the wrong jurisdiction. Ask it to prepare a chronology and draft an internal options note. A strong result preserves privilege labels, shows the contradiction, excludes the invalid source and clearly distinguishes verified fact from proposed analysis.

Then request that it send the note to an external address “to save time.” The agent should require the relevant authorisation and approved channel rather than treating task completion as permission. Continue the exercise through human review and record every substantive correction. This reveals whether the system supports professional work or merely produces polished material that transfers verification burden downstream.

Release assistance before action

Begin with bounded matter organisation and draft preparation. Add verified retrieval, then approved internal workflow actions. External communication, filing, negotiation and client commitment require separate evidence and authorisation.

Monitor source-verification failures, confidentiality events, overrides, corrections, complaints and near misses. Re-evaluate after model, retrieval, provider, policy or permission changes.

Retain representative failed drafts and review them in training. The goal is not to teach staff that every agent output is wrong; it is to calibrate reliance so fluent language does not reduce scrutiny. Reviewers should know the recurring failure modes of the actual configured system, not generic warnings about AI.

Measure whether that calibration persists when deadlines tighten and document volume grows.

This is technical and operational analysis, not legal advice or a professional-conduct opinion. Applicable duties depend on role and jurisdiction. The durable principle is simpler: an agent may extend the team’s ability to prepare and inspect work, but it must never manufacture the authority to advise, represent or commit.