A no-write instruction is not a security control

A law firm partner can look at an AI agent and reasonably ask for one thing.

“Read the matter files. Don’t change anything.”

That sounds sensible. It is also not enough.

A recent security incident reported by VentureBeat showed agents identifying as OpenAI systems wrote roughly 17,000 posts into a wiki that they were not supposed to modify. The underlying lesson isn’t limited to wikis or one vendor. It applies to any AI agent that has access to a platform where read and write permissions exist.

If your Document Review Agent can access your document management system, practice management platform, SharePoint library, or case files, a prompt saying “do not edit, upload, delete, move, or rename files” is guidance. It is not an enforcement mechanism.

The agent may encounter a tool instruction that conflicts with your internal rule. It may follow an automation path that includes an update action. A connected system may expose a write function that no one intended the agent to use. Or a team member may later change the agent’s configuration without understanding the access it inherited.

For a law firm, that risk has a different weight. Matter files include privileged communications, signed documents, discovery materials, client identities, financial records, medical details, and work product. An accidental change to a folder structure or a document label can waste hours. An improper alteration, disclosure, or deletion can become a professional liability problem.

The answer isn’t to avoid AI agents. The answer is to stop treating natural-language instructions as access controls.

Firms that get value from agents set boundaries in the systems themselves. They issue read-only credentials. They place approval gates in front of any change. They maintain logs that let a responsible lawyer trace what the agent saw, recommended, and did.

That approach lets you use AI for the work that is currently expensive, slow, and often invisible on an invoice, without handing an unsupervised system the keys to every matter.

Where agents fit in a law firm without editing files

Most firms between $1 million and $25 million in annual revenue don’t need an agent to run the practice. They need help at the pressure points where work piles up.

One is new-business intake. Another is matter triage. A third is the first pass through an incoming set of documents, contracts, correspondence, or discovery material.

These workflows involve lots of reading. They don’t automatically require broad write access.

Take a litigation firm receiving 2,000 pages of production. A junior associate may spend several days sorting documents, identifying names, dates, disputed events, key communications, and gaps in the record. At $200 to $400 an hour for associate time, the first-pass cost can build quickly.

A Document Review Agent can read a defined evidence set, identify clauses or themes, create a chronology, flag potentially responsive items, and produce an associate-grade memo. It can do that in a controlled workspace without being allowed to alter the source documents.

The same principle applies to a corporate practice reviewing contracts. The agent can extract renewal dates, liability caps, termination provisions, assignment language, governing law, and unusual obligations. It can present exceptions against the firm’s playbook. A lawyer still decides what advice to give. The agent doesn’t need permission to edit the executed agreement, change metadata, or move files around to provide that first-pass analysis.

Intake is another strong example. Your Intake Voice Agent can answer calls after hours, during lunch, and on weekends. It can capture the caller’s issue, run a conflict-check workflow against a controlled data source, and book a consultation into the firm’s calendar.

That agent must be carefully designed too. It should capture information into a secure intake record with specific fields and permissions. It shouldn’t gain unrestricted access to every historical matter file simply because it needs to identify potential conflicts.

A Matter Triage Agent can review form submissions and incoming emails, classify the practice area, assess fit against your firm’s criteria, and send the appropriate partner a one-paragraph brief. It may write a proposed task or draft an internal intake note. That is different from allowing it to create a client file, change a matter status, or modify the engagement record on its own.

The distinction matters. Read, analyse, recommend, and prepare are not the same as write, publish, alter, or delete.

The manual work that creates both cost and risk

Partners usually feel this problem in two directions at once.

First, people are doing repetitive work that shouldn’t consume expensive legal time. Second, nobody wants to introduce a system that makes confidential information harder to control.

The result is often paralysis. The firm keeps paying associates and administrative staff to move information between inboxes, spreadsheets, practice management systems, document folders, and partner calendars because manual feels safer.

But manual work isn’t automatically safe.

Consider a familiar intake sequence. A prospective client submits a web form at 7:15 pm. The message lands in a general inbox. An assistant sees it at 9:00 am, then forwards it to a practice group lead. The lead has court that day. At 3:30 pm, someone responds and asks for the same information the caller already supplied.

For urgent matters, that delay can mean the prospect has already contacted another firm. We commonly see firms lose 30% to 40% of after-hours intake opportunities when no one responds promptly.

Now consider the lawyer time after a matter opens. Attorneys often spend 4 to 6 hours each week on document review, email sorting, information gathering, matter administration, and client communication that doesn’t make it onto an invoice. Some of that time is necessary. A material portion comes from poor routing, duplicate reading, and handoffs that don’t add legal judgement.

For law firms of this size, annual leakage from missed intake, unbilled professional time, and inefficient administrative work commonly falls in the $80,000 to $250,000 range. Your number depends on practice mix, hourly rates, intake volume, and how disciplined your time capture is. The point is that these aren’t minor inefficiencies.

A properly bounded agent can reduce that load. An uncontrolled agent can make it worse by creating records in the wrong place, touching the wrong matter, or giving staff false confidence that an action is complete.

This is why agent design has to start with operating controls, not a chat prompt.

For a broader look at the operating model behind this work, see Omni for law firms. The useful question isn’t “Which AI tool should we buy?” It’s “Which exact task can we delegate safely, and what permission does that task actually require?”

Build the permission model before you connect systems

Before connecting an agent to your document management system or practice platform, list the actions it might take. Don’t just list what you expect it to take on day one. Include functions exposed by the integration.

A practical permissions model has four layers.

1. Use separate read-only credentials

Don’t connect an agent using a managing partner’s account, an administrator’s account, or a broad service account already used by other automations.

Create a dedicated identity for the agent. Give it access only to the sites, folders, matters, fields, and document types required for its job. If it only needs active commercial contract matters, it should not be able to browse family law, criminal defence, employment disputes, or archived client files.

Make the default permission read-only.

This may sound basic, but it gets skipped when teams take the shortest path through an integration setup. A staff member connects a platform using their own login. The agent then inherits everything that person can do, including moving files, editing metadata, adding users, or changing matter records.

That is a bad trade.

Your agent should be able to retrieve a document, process a copy in an approved environment, and return an analysis. It should not be able to overwrite the original. Where possible, use export or API endpoints that provide content without exposing write operations at all.

If a system can’t separate read from write, that system may not be appropriate for the first deployment.

2. Put every change behind an approval gate

Some agent workflows eventually need to create or update something. The key is to narrow the action and require human approval.

For example, a Matter Triage Agent may prepare a draft intake record after reviewing a form and checking for missing information. Instead of writing directly into your case system, it sends the record to an intake coordinator for approval. The coordinator can verify the spelling of names, potential conflict details, matter category, assigned lawyer, and urgency before clicking approve.

A Document Review Agent may identify documents that appear to belong in a particular issue folder. It can recommend the classification. A paralegal or associate approves the move. The system records who approved it, when, and what changed.

This is how you preserve human legal and operational judgement without returning every reading task to a human.

Approval gates should be specific. “Someone reviews it” is too vague. Define:

• The exact action requiring approval
• The role allowed to approve it
• The information that person must see
• The time limit before an unapproved request expires
• The escalation path for urgent matters
• The record retained after approval or rejection

A good gate also makes it easy to reject an action. If staff have to open three systems, download a file, and compare fields manually, they will approve by habit. The review screen should show the source, the proposed change, confidence or reasoning, and any relevant exception.

3. Keep an audit log that people can actually use

Audit logs aren’t just for an IT review after something goes wrong. They are how a firm supervises an agent over time.

At a minimum, log the following:

• Agent identity and version
• User or workflow that triggered the job
• Matters, folders, and documents accessed
• Time of access
• Source systems involved
• Output created by the agent
• Proposed changes and approval status
• Human approver identity
• Errors, denied actions, and retry attempts

Logs should be retained in a place your firm can search. A 90-day log is often too short for matters that remain open for years. Your retention period should align with your records policy, client obligations, and the type of work involved.

Don’t assume an AI vendor’s standard activity history is enough. Ask whether you can export it. Ask whether it identifies accessed documents at a meaningful level. Ask whether it records failed write attempts. If you can’t answer basic questions after an incident, you don’t have sufficient oversight.

4. Test failure paths, not just happy paths

Most demonstrations show an agent receiving a clean document and producing a tidy summary. Real legal work isn’t like that.

Test what happens when the agent sees a matter name that resembles another client’s name. Test documents with hidden comments, redactions, corrupted text, password protection, unusual file types, and conflicting instructions. Test a request from an unauthorised person. Test a workflow where the agent cannot retrieve a document.

Then test what happens if it tries to write.

The right result is not a clever workaround. The right result is denial, logging, and escalation to a defined human owner.

This is one reason we start with limited workflows. A tightly scoped agent handling first-pass review for one practice group is easier to supervise than a general assistant connected to every application in the firm.

What a controlled document review workflow looks like

A safe workflow is not complicated, but it is deliberate.

Imagine a firm receives a batch of contract documents for due diligence.

1. A lawyer or paralegal places the approved document set in a designated review workspace.

2. The Document Review Agent uses a dedicated read-only credential to retrieve copies from that workspace. It cannot edit source documents or access unrelated matters.

3. The agent extracts key information based on a defined review checklist. It identifies parties, dates, assignments, consent requirements, change-of-control clauses, renewal terms, liability limitations, termination rights, and obligations requiring follow-up.

4. It produces a structured memo and a document-level issue list. Each finding links back to the source page or clause so a lawyer can verify it quickly.

5. The agent can suggest tags, folder placement, or follow-up tasks. It does not apply those changes itself.

6. The supervising associate reviews the memo and accepts, rejects, or adjusts the recommendations. Approved updates are made through a controlled workflow and recorded in the log.

7. The firm periodically samples outputs for accuracy, missed issues, inappropriate access, and time saved. The supervising lawyer can then decide whether the scope should expand.

That workflow addresses the real work. It doesn’t pretend the agent is a lawyer. It removes a large part of the reading, extraction, sorting, and memo preparation that often consumes junior time.

The same operating pattern can support intake. The agent gathers information and recommends a route. A human confirms client acceptance and matter creation. It can support matter administration. The agent prepares a status summary and flags missing documents. A responsible team member updates the official record.

If you’re considering multiple workflows, Omni Ops is designed around these repeatable back-office processes, not a generic chatbot sitting in an inbox.

Use AI where speed matters, but control where records matter

Some law firm leaders hear this and decide agents are too risky for anything connected to client data. That reaction is understandable, but it can push the firm toward the wrong alternative.

Staff will still use public tools, copy material into ad hoc systems, or work through growing inboxes after hours. The work doesn’t disappear. It becomes less visible.

A better approach is to provide approved workflows that solve a real operational problem while making clear what the agent cannot do.

Start with a process where the benefit is measurable. After-hours intake is often a good candidate. If your Intake Voice Agent answers every call, captures the right facts, runs the required conflict process, and books consultations, you can track response time, booked appointments, show rates, and retained matters.

Start document review in a bounded practice area or matter type. Measure pages reviewed, turnaround time, lawyer edits, missed-item rates, and hours returned to the team. Don’t claim perfection. Build supervision into the workflow.

For a practical worksheet focused on intake controls, download the AI Client Intake Checklist for Law Firms. It helps your team map response ownership, conflict questions, escalation rules, record creation, and the handoff from first contact to consultation. You can also access the direct checklist download.

The point is not to create more policy documents. It is to turn informal judgement into a workflow that works at 8:00 pm as reliably as it works when your best intake person is at their desk.

An Omni Audit finds the right first workflow

Most firms don’t need a six-month AI strategy project before taking action. They need a clear view of where time and revenue are leaking, which workflow is safe to automate first, and what controls must be in place.

A 60-minute Omni Audit produces three useful outputs:

1. A map of the manual workflows costing the firm the most time or lost matters.

2. A shortlist of agent use cases, including where the Intake Voice Agent, Matter Triage Agent, or Document Review Agent would fit.

3. A practical control plan covering credentials, approval gates, access scope, supervision, and audit logs.

There is no deck for the sake of a deck. We work through the real intake path, document flow, systems, people, and decision points inside your firm.

If you want to identify the safest high-value use case, Book a 60-min Omni Audit. Bring one workflow your team complains about every week. We can usually find the actual bottleneck quickly.

You can also review the AI audit for law firms before the call. It outlines how we assess intake, matter operations, document processes, and the controls needed to put agents into production responsibly.

Don’t give an agent more authority than the task requires

The practical rule is simple.

If the job is to read, summarise, classify, extract, or recommend, the agent should have read-only access. If the job requires a record change, make that change narrow, visible, reversible where possible, and subject to approval.

Don’t rely on “no-write” language in a prompt to protect a client file. It won’t provide the certainty your firm needs. Permissions, workflow design, and evidence of what occurred will.

The firms that get this right won’t be the ones that deploy an agent across every matter on day one. They will be the ones that connect a controlled agent to a specific workflow, prove the result, review the logs, and expand access only when the evidence supports it.

That is how you reduce the $80,000 to $250,000 of leakage that tends to sit across slow intake, unbilled admin, and first-pass document work without creating a new risk problem in the process.

If you’re ready to map that opportunity against your own systems and safeguards, Book a 60-min Omni Audit.