AI agents need a written line of authority

Law firms are adopting AI agents because the work is obvious. Calls arrive after hours. Intake forms sit untouched. Associates spend days reading contracts, discovery files, and prior correspondence. Partners need a clean answer, not another raw document dump.

The opportunity is real. So is the risk.

An AI agent can answer a prospective client’s first call, collect key facts, identify the likely practice area, and book a consultation. It can review a 400-page discovery batch, identify responsive documents, flag privilege language, and produce a first-pass memo. It can compare a vendor contract against an approved clause library and highlight deviations in minutes.

None of that means the agent should decide whether to accept a client, give legal advice, approve a settlement position, or send a contract amendment to a counterparty.

That distinction needs to be written down before agents are placed inside live workflows.

For a law firm, AI governance isn’t a generic technology policy sitting in a shared drive. It’s a practical operating framework that answers one question at every step: what can the agent do on its own, and where must an attorney take over?

If your firm is in the $1 million to $25 million revenue range, unclear ownership is where useful automation becomes a liability. A partner assumes the intake team is checking conflicts. The intake team assumes the system is doing it. An associate assumes a contract summary is complete because it reads well. Nobody has documented the review threshold.

That’s how risk enters a matter.

The AI audit for law firms is designed to map those handoffs before you deploy more tools. It looks at the work, the authority boundaries, the data involved, and the commercial impact.

Start with the work that is already leaking time

Most firms don’t need an AI agent because they want an AI agent. They need one because too much paid legal capacity is tied up in repeatable work.

We usually see three pressure points.

First, billable-hour leakage. Attorneys and senior paralegals spend time on client intake, chasing missing information, matter setup, reviewing routine correspondence, updating systems, and preparing internal status notes. Much of it doesn’t reach an invoice. A common range is 4 to 6 unbilled hours per attorney each week, especially in firms where partners still act as the final routing point for everything.

Second, intake delays. A potential client calls at 6:30 p.m. after searching for a local employment, personal injury, family, or commercial lawyer. The call goes to voicemail. An online form arrives with enough information to create urgency, but no one responds until the next morning. Firms often find that 30% to 40% of after-hours inquiries don’t convert, partly because the prospect has already contacted another practice.

Third, document review and discovery. The junior team reads the first pass because someone has to. At associate billing rates commonly in the $200 to $400 per hour range, even a modest review queue creates a real cost. The issue isn’t that associates shouldn’t review documents. They should. The issue is asking them to spend expensive hours locating obvious clauses, sorting documents, and building basic chronologies before they can apply legal judgment.

AI agents can remove friction in all three areas. They shouldn’t remove professional accountability.

A firm needs a governance framework that protects the attorney-client relationship while allowing the agent to do the lower-risk, repeatable parts of the workflow.

Define autonomy in four levels

The simplest governance model is a four-level authority matrix. It gives every agent action a clear status.

Level 1: Observe and prepare

At this level, the agent can read approved information and produce internal work product. It doesn’t communicate externally, change records, make recommendations on legal outcomes, or trigger a workflow without a human.

A Document Review Agent might:

• Extract parties, dates, definitions, payment terms, renewal clauses, and termination rights from a contract
• Compare language against the firm’s approved playbook
• Create a chronology from emails, invoices, and pleadings
• Identify potentially responsive discovery documents
• Draft an internal summary with page references and confidence markers

This is a strong starting point for most firms. The output is useful, but it remains a draft. An attorney or assigned reviewer owns the decision to rely on it.

The governance rule should say that the agent’s work product is an internal aid, not legal advice, not a final filing, and not a substitute for professional review.

Level 2: Act within fixed rules

At Level 2, an agent can take defined administrative actions when conditions are clear and documented.

The Intake Voice Agent can answer every call, including weekends and lunch hours. It can capture the caller’s name, contact details, legal issue, location, urgency, opposing party details, preferred appointment time, and referral source. It can then offer approved consultation slots directly in the firm’s calendar.

It can also run a preliminary conflict screen against a controlled list of names and entities, provided the policy is clear that this is not a final conflicts determination.

That last point matters. The agent can identify potential conflicts. It should not tell a caller, “There is no conflict and we represent you.” The approved language should be closer to: “We need to complete our standard conflict review before confirming representation.”

The same principle applies to communications. The agent may send an acknowledgement, appointment confirmation, secure upload instructions, or a request for missing intake documents. It should not answer substantive legal questions, estimate case value, promise an outcome, or create an engagement.

Level 3: Recommend and escalate

At this level, the agent can make a recommendation and route it to the right person. It still cannot make the final call.

The Matter Triage Agent is a good example. It reviews incoming forms and emails, classifies the practice area, identifies urgency signals, scores fit against the firm’s stated criteria, and routes the matter to the right partner or intake owner. It attaches a one-paragraph brief covering the facts, potential issues, likely next step, conflict-screen status, and missing information.

The agent might label a lead as high priority because there is an impending filing deadline, an active workplace investigation, or an expiring limitation period. It can suggest that a partner review the matter within 30 minutes. It should not reject the lead automatically because it appears too small, too complex, or outside an initial keyword rule.

Why? Because the exceptions are where good firms make their money and protect their reputation. A seemingly small commercial dispute may involve a major existing client. A family matter that looks routine may involve an urgent safety issue. A keyword-based rejection can become both a commercial and professional problem.

Level 4: Attorney-only decisions

This level must be explicit. These are actions the agent cannot take, even if the technology appears capable.

Attorney-only actions usually include:

• Confirming representation or issuing an engagement agreement
• Making a final conflict determination
• Giving legal advice or interpreting law for a client
• Approving a filing, court submission, demand letter, or settlement communication
• Selecting a legal strategy or advising on a litigation position
• Making final privilege, relevance, or responsiveness calls in discovery
• Negotiating contract terms with an external party
• Closing a matter, writing off fees, or agreeing to a billing adjustment
• Sharing client data with a tool or vendor outside the firm’s approved environment

Put these boundaries into a one-page authority matrix. Attach it to each workflow. Train people on it. Then test it with real examples before an agent reaches a live client or matter file.

Govern the Document Review Agent before it touches a file

Document review is often the first place firm leaders see a major productivity gain. It is also where overconfidence can create expensive mistakes.

A Document Review Agent can perform a first-pass review on contracts, discovery batches, and matter files. It can flag clauses, summarise positions, identify deviations from a playbook, and produce an associate-grade memo. That gives the reviewing lawyer a better starting point.

But “associate-grade” doesn’t mean “attorney-approved.”

Your written policy should cover the full workflow.

First, define the permitted source material. Which document repositories can the agent access? Can it read client email? Can it access closed files? Are there matter-level permissions? If the agent can’t distinguish between a current matter and a restricted internal investigation, the access model isn’t ready.

Second, define the output standard. A summary should include document citations, clause references, and a statement of uncertainty where needed. The agent shouldn’t present a conclusion as certain when the underlying language is ambiguous or incomplete.

Third, define escalation triggers. Examples include missing pages, conflicting versions, unclear governing law, unusual indemnity language, a limitation of liability clause outside the approved range, personally identifiable information, privileged material, or a deadline within 72 hours.

Fourth, define human sign-off. A lawyer should review outputs before they are sent externally, entered into a client-facing work product, used to decide discovery responsiveness, or relied upon for legal advice.

This isn’t bureaucracy. It’s a control that protects quality while preserving the time benefit.

If an agent saves an associate 8 hours on a contract batch but the supervising lawyer needs 45 minutes to validate the findings, that is still an attractive workflow. The partner gets faster visibility. The associate spends time on analysis rather than hunting for clauses. The client receives a more timely response. The lawyer remains accountable for the advice.

You can see how these workflows connect across Omni Ops, where the focus is on routing, reviews, internal approvals, and operational follow-through.

Build a policy around decisions, not software

Many AI policies fail because they begin with a list of approved tools. Tool approval matters, but it doesn’t answer the harder questions.

A policy that says “staff may use approved AI tools for administrative work” is too vague. What counts as administrative work? Can a paralegal use an agent to draft a client email? Can an intake agent schedule a call after a preliminary conflict match? Can the Document Review Agent pull clauses from an acquisition agreement? Who reviews the answer?

Build your policy around decision points instead.

For each agent, document:

1. Purpose
   State the business outcome. For example, reduce response time for qualified intake calls while preserving conflicts and attorney review.

2. Inputs
   List the data the agent can receive. Include client-provided information, matter data, approved templates, calendars, conflict databases, and clause libraries.

3. Allowed actions
   Be specific. “Schedule consultations within approved calendar rules” is specific. “Handle intake” is not.

4. Restricted actions
   List actions requiring attorney approval or prohibited completely.

5. Escalation rules
   Identify keywords, risk signals, dollar thresholds, deadline windows, and uncertainty conditions that trigger human review.

6. Reviewer role
   Name the role that owns the decision. Avoid assigning this to “the team.” A named function is better, such as intake partner, supervising associate, conflicts counsel, or practice lead.

7. Audit trail
   Record the source documents, agent output, reviewer edits, approval status, and final action. If a question arises later, the firm needs to know what happened and who approved it.

8. Testing and review cycle
   Review early workflows weekly for the first 30 days. After that, a monthly sample review is often sensible. Revisit the policy when the agent gains new permissions, a practice group changes process, or a near miss occurs.

A practical governance framework is not a 40-page manual. For most agent deployments, a short policy, workflow map, authority matrix, and review log will do more than a broad document nobody reads.

The intake workflow is where governance meets revenue

The financial case is straightforward. Missed calls and slow follow-up quietly reduce signed matters. Unbilled administrative work quietly lowers partner capacity. First-pass document review quietly inflates delivery cost.

Across a law firm of this size, those operational gaps can reasonably sit inside an $80,000 to $250,000 annual leakage band. The exact number depends on practice mix, attorney utilisation, lead volume, hourly rates, and how consistently work is billed.

The Intake Voice Agent gives you a useful governance test because the workflow is clear.

A caller rings at 8:15 p.m. The agent answers, identifies the firm, explains that it can collect information for the team, and asks permission to proceed. It captures the matter details. It asks for names relevant to a preliminary conflict check. It identifies any deadline or safety issue. It schedules a consultation if the matter meets the firm’s stated criteria.

Then the boundary matters.

The agent does not claim the firm represents the caller. It does not advise the caller to take or avoid a legal step. It does not guarantee a partner will accept the matter. It sends the Matter Triage Agent a structured record, which produces a brief for human review.

That is a valuable workflow because speed and control can coexist.

For a practical worksheet, download the AI Client Intake Checklist for Law Firms. It helps you identify the questions an intake agent can ask, the information that should trigger escalation, and the handoff points that need attorney ownership. If you want the file directly, use this direct download.

The checklist won’t replace firm-specific policy, but it gives you a credible starting point for the conversation with your intake lead, partners, and risk team.

Run a 60-minute governance review before rollout

You don’t need to pause every AI initiative until you have a committee. You do need to understand where the agent sits in the work and what it is allowed to do.

Start with one workflow. Intake is usually the best choice because the value is visible and the authority boundaries can be defined quickly. Document review is often next, especially where junior associates are spending long hours on repeatable first-pass work.

In a 60-minute Omni Audit, we produce three things:

• A map of the manual workflow and the points where time, leads, or review quality are leaking
• A proposed agent design with authority boundaries, escalation rules, and attorney approval points
• A commercial view of the opportunity, including where recovered capacity or improved conversion can justify the investment

There is no deck to sit through. We work from the actual operating reality of your firm.

If you’re considering an intake agent, start with Omni Voice. If the harder issue is the routing, document handling, and internal review layer, look at Omni Ops. The broader Omni for law firms page shows how these pieces fit around the firm’s existing people and systems.

The important point is this. Don’t ask an AI agent to “handle contracts” or “manage intake.” Give it defined authority, clear limits, a human owner, and a traceable review path.

That is how you gain speed without handing professional judgment to a system that cannot carry it.

If you want to map the first workflow and write the right boundaries before the rollout gets ahead of governance, Book a 60-min Omni Audit.