Legal AI agent for law firms: what "agentic" should mean

"Agentic AI" now describes everything from a chatbot with a button to software that works through a task on its own. For a law firm the useful question is narrower: what is the agent allowed to do, and who decides?

Read, draft and act are three different permissions

Most of the risk in a legal AI agent sits in one distinction. Treat these as separate levels, and ask a vendor which level each step runs at.

A plan you can read before it runs

The clearest sign of a well-built agent is that it shows its plan first. This is how a job looks before anything runs: the request, a five-step plan, and a label on every step saying whether it runs on its own or waits for you. The screen uses sample data.

1 2 3 4

1. The plan names where it was written: here, a model running on the firm's own server.
2. Read steps run without asking, because they change nothing.
3. The step that writes outside the workspace asks first.
4. A plain summary of what it saw, what it can do, and what it will not send.

The agent works as you, not as a superuser

An agent that can see everything is a confidentiality problem with a friendly interface. In a law firm the agent should inherit exactly what the lawyer using it may open. If a matter is walled off from that lawyer, it is walled off from the agent too, and the walled material should be dropped before any model reads it.

Several agents, one set of walls

Many firms will want a general-purpose assistant to reach firm material alongside the agent built into the workspace. VaultScribe treats outside assistants as guests: an administrator approves each one, it sees only the matters the firm chooses, access expires, every write asks first, and it cannot reach raw audio. The built-in agent and every guest answer to the same walls and the same log. Connecting another AI should add a controlled door, not remove a wall.

What a responsible agent proposes and does not decide

• Deadlines. It can do the date arithmetic and propose a deadline. A lawyer confirms the rule before anything reaches a docket.
• Time. It can draft an entry while a call is fresh. It should never post time on its own.
• Conflicts and privilege. It can flag a possible issue. It should not declare a conflict cleared or a document privileged.
• The record. A machine transcript is a machine transcript, not a certified record.

This matches the direction of the ABA's Formal Opinion 512 (July 29, 2024), which says lawyers may not hand tasks that call for their own judgment to an AI tool. Read the opinion. Your state's rules may differ.

Six questions to ask any legal AI agent vendor

1. Can I see the plan before it runs, and edit it?
2. Which steps can change something outside the system, and does each one ask first?
3. Does it act as me or as a service account? Ask what it can see that I cannot.
4. What happens when a document or email tells it to do something? Instructions inside outside content should never steer the agent.
5. Is every action in a log I can read?
6. Who can connect another AI to it, and for how long?

Questions

Related: Security and architecture, Private legal AI and AI for law firms: a task-by-task map. General information, not legal advice.