The junior associate who left three months ago still has access to your document management system. You know this because IT keeps pushing the offboarding ticket to next week. The risk sits there, dormant, until someone notices or something breaks.

Now imagine that same credential handed to an AI agent that runs 24 hours a day, processes thousands of documents per week, and never takes a lunch break. The speed and scale turn a familiar identity problem into something law firms aren’t equipped to handle.

AI agents don’t get tired. They don’t forget passwords. They inherit access tokens that live for months, sometimes years, and they use those tokens at machine speed across every system you’ve connected. When an agent has the keys to your client intake CRM, your matter management platform, and your document repository, a single compromised credential becomes a firm-wide exposure in minutes.

This isn’t theoretical. One mid-sized litigation firm in our network discovered their document review agent had retained access to a former partner’s OneDrive for eleven months after the partner’s departure. The agent had been summarising and tagging files across that account, mixing privileged material with general discovery documents, because no one thought to audit what the AI could see.

The new insider has no pulse. It’s an API key with permissions you granted six months ago and forgot about. It’s a service account that was supposed to be temporary. It’s the OAuth token your intake agent uses to write directly into your case management system, issued by a paralegal who left in April.

The Credential Problem Law Firms Don’t See

Law firms are used to managing human access. Partner leaves, you disable their account. Associate moves to another practice group, you adjust their folder permissions. The process is manual, but it’s bounded by the number of people in the firm.

AI agents break that model. A single agent can hold credentials for a dozen systems. Your intake voice agent might authenticate against your phone system, your CRM, your calendar, your conflict-check database, and your billing platform. Each connection is a separate token, often with different expiration policies, issued by different vendors, managed in different admin consoles.

Most firms have no central view of which systems their AI tools can access. The paralegal who set up the intake agent clicked “Allow” on five OAuth prompts and moved on. The IT manager who configured the document review agent created a service account with “read/write” because “read-only” didn’t work and no one had time to troubleshoot.

The credentials live forever, or close to it. API keys default to no expiration. OAuth tokens refresh automatically. Service accounts never retire unless someone explicitly disables them. The agent keeps working, which feels like success, until you realise it’s been writing client data to a Slack channel that includes two former employees and a contractor who finished their project eight months ago.

Privilege risk compounds when agents operate across matter boundaries. A document review agent trained to spot relevant clauses in discovery doesn’t understand which files belong to which client. It sees everything its credentials allow. If those credentials grant access to your entire document library, the agent will happily pull examples from Client A’s privileged memos to inform its summary of Client B’s contract dispute.

One trusts and estates firm found their matter triage agent had been appending intake notes to the wrong client records for six weeks. The agent’s CRM token had “global write” permissions, and a misconfigured routing rule meant new estate planning inquiries were being attached to active litigation matters. No human would make that mistake at that scale. The agent processed 340 intakes before someone noticed.

What Machine-Speed Access Means for Your Firm

Human insiders move slowly. A disgruntled associate might download a few files before they leave. An external attacker who compromises a single account will try to stay quiet, exfiltrating data in small batches to avoid detection.

AI agents don’t exfiltrate. They operate. They read, write, summarise, route, and tag at a pace no human can match. If an agent’s credentials are compromised or misconfigured, the damage unfolds in hours, not weeks.

Consider your intake voice agent. It answers every call, captures the matter details, checks for conflicts, and books a consultation. That’s exactly what you want. But to do that work, the agent needs access to your phone system, your CRM, your calendar, and your conflict database. If any one of those tokens leaks or if the agent’s hosting environment is breached, an attacker can query your entire client list, read intake notes, and see which matters are marked confidential. The agent’s speed becomes the attacker’s speed.

Document review agents present a different risk. They process discovery batches, flag clauses, and summarise positions. To do that, they need read access to your document repository. In most firms, that means access to everything, because no one has time to configure per-matter permissions for a service account. The agent sees active files, archived files, privileged memos, and draft briefs. If the agent’s credentials are compromised, so is your entire document library.

The risk isn’t just external. Misconfigured agents leak privilege internally. A matter triage agent that routes incoming emails might have access to your general inbox, your client portal submissions, and your internal case notes. If the agent’s logic breaks or its permissions are too broad, it can route privileged communications to the wrong partner, copy client details into shared Slack channels, or append sensitive notes to the wrong matter record.

One commercial litigation firm discovered their document review agent had been summarising privileged attorney-client memos and including those summaries in discovery reports sent to opposing counsel. The agent’s prompt didn’t distinguish between discoverable documents and privileged communications. Its credentials allowed access to both. The agent did exactly what it was trained to do, at scale, for three months before a senior associate noticed a reference that shouldn’t have been there.

Audit What Your AI Can See

Most law firms don’t know which systems their AI agents can access. The credentials were issued during setup, the agent works, and no one revisits the permissions until something breaks.

Start with an inventory. List every AI tool your firm uses. For each tool, document which systems it connects to and what level of access it has. Your intake voice agent probably touches your phone system, your CRM, your calendar, and your conflict database. Your document review agent likely has access to your document repository and possibly your email archive. Your matter triage agent might read your client portal, your general inbox, and your case management system.

For each connection, find the credential. Is it an API key? An OAuth token? A service account? Where is it stored? Who issued it? When does it expire?

Most firms discover credentials they didn’t know existed. The OAuth token issued by a paralegal who left two years ago. The API key embedded in a script that still runs every night. The service account created during a trial period that became permanent.

Next, check permissions. Does the agent have read-only access or read-write? Is access scoped to specific matters or does the agent see everything? Can the agent modify records, delete files, or invite users?

In most cases, agents have more access than they need. The intake agent has write access to your CRM when it only needs to create new records. The document review agent has access to your entire document library when it only needs to see discovery files for active matters. The matter triage agent can read your internal case notes when it only needs to see client-facing intake forms.

Scope credentials to the minimum required. If the agent only needs to read intake forms, don’t give it access to your case notes. If the agent only needs to write to a specific CRM module, don’t grant global write permissions. If the agent only processes documents for certain practice areas, restrict access to those folders.

Implement time-limited credentials. API keys should expire. OAuth tokens should require re-authorisation. Service accounts should have a defined lifecycle. If you can’t set an expiration date, put a recurring review on the calendar. Every 90 days, audit which agents are running and which credentials are still active.

One family law firm cut their credential exposure by 60% just by switching from permanent API keys to 90-day tokens. The agents still worked. The firm just had a forcing function to review access every quarter and disable tokens that were no longer needed.

The Omni Audit for Law Firms

We built the AI audit for law firms because most firms don’t have time to map their AI exposure manually. The Omni Audit is 60 minutes. You walk me through which AI tools you’re using, where your client data lives, and which systems your agents connect to. I’ll show you exactly what each agent can see, which credentials are over-permissioned, and where privilege risk is highest.

You’ll leave with three outputs. First, a credential map that lists every AI connection, the access level, and the expiration policy. Second, a risk score for each agent based on what it can access and how it’s used. Third, a remediation plan that prioritises which credentials to scope down, which tokens to rotate, and which agents need better isolation.

No deck. No follow-up meeting to “present findings”. You get the outputs during the call, and you can act on them the same day.

For most law firms, the audit surfaces at least three credentials that should’ve been disabled months ago and two agents that have access to systems they don’t need. One estate planning firm found their intake agent had retained access to a former partner’s email account for fourteen months. The agent was scanning that inbox for new client inquiries and appending them to active matters. No one noticed because the agent kept working.

Book a 60-min Omni Audit and we’ll map your AI exposure in a single call.

Named Agents That Carry Credential Risk

The agents we build at Enterprise DNA are designed to reduce manual work, but they still inherit the same credential risks every AI tool faces. The difference is we scope permissions from day one and build in credential rotation as part of the deployment.

Our Intake Voice Agent answers every call after-hours, on weekends, and during lunch. It conflict-checks the caller, captures the matter, and books a consultation directly into your calendar. To do that, it needs access to your phone system, your CRM, your calendar, and your conflict database. We issue separate credentials for each system, scope them to create-only where possible, and rotate them every 90 days. The agent works exactly the same, but the exposure is bounded.

One personal injury firm using the Intake Voice Agent had a credential compromised during a phishing attack. Because the agent’s CRM token was scoped to create new records only, the attacker couldn’t read existing client data or modify matter details. The firm rotated the token, and the agent was back online in 20 minutes. If the token had been global read-write, the breach would’ve exposed their entire client list.

Our Matter Triage Agent reviews incoming form submissions and emails, classifies practice area, scores fit, and routes to the right partner with a one-paragraph brief attached. It needs read access to your client portal and your general inbox, and write access to your case management system. We scope the write access to a single “intake” module, so the agent can’t modify existing matters or access closed files. The read access is filtered to exclude internal case notes and privileged memos.

One commercial firm using the Matter Triage Agent discovered their general inbox included a thread with opposing counsel that should’ve been marked privileged. The agent flagged the email as a new intake and routed it to a junior partner. Because the agent’s access was scoped to client-facing submissions, it didn’t pull in the rest of the thread or append it to the active matter. A human caught the mistake in minutes, not months.

Our Document Review Agent performs first-pass review on contracts, discovery batches, and matter files. It flags clauses, summarises positions, and produces an associate-grade memo. This agent needs the broadest access, because document review spans your entire repository. We isolate it by matter. Each review job gets a temporary credential scoped to a single matter folder. The credential expires when the review is complete. The agent never has standing access to your full document library.

One litigation firm using the Document Review Agent ran a discovery batch that included privileged memos mixed with responsive documents. The agent flagged the memos as out-of-scope and excluded them from the summary. Because the agent’s credential was scoped to that specific discovery folder, it couldn’t access other matters or pull in examples from unrelated cases. The privilege risk was contained to a single batch, not the entire repository.

Practical Steps You Can Take This Week

You don’t need to rebuild your AI stack to reduce credential risk. Start with three steps you can complete in a week.

First, list every AI tool your firm uses and every system it connects to. Don’t try to map permissions yet. Just document which agents are running and which platforms they touch. Most firms find at least one agent they forgot about and two connections that shouldn’t exist.

Second, identify which agents have access to privileged material. Your document review agent almost certainly does. Your matter triage agent might. Your intake agent probably doesn’t, unless it’s reading your case notes. For each agent that touches privileged data, check whether access is scoped to specific matters or whether the agent sees everything.

Third, pick one credential to rotate. Find the oldest API key or the most over-permissioned service account and replace it with a time-limited token. If the agent breaks, you’ll know which connection was misconfigured. If it keeps working, you’ve reduced your exposure with zero downtime.

If you’re setting up a new AI tool, insist on scoped credentials from day one. Don’t accept “global read-write” as the default. Don’t let the vendor tell you they need access to your entire CRM to create a single record. If the setup process requires permissions the agent doesn’t need, push back or find a different tool.

One real estate law firm adopted a rule that no AI agent gets access to more than two systems without partner approval. The rule forced the team to think about what each agent actually needed and to document why each connection was required. It added 20 minutes to each deployment, but it cut credential sprawl by half.

We’ve also put together a practical worksheet that walks through the intake process step by step. The AI Client Intake Checklist for Law Firms covers which systems your intake agent needs to touch, what level of access is required, and where privilege risk is highest. You can download it here: AI Client Intake Checklist. It’s a one-page reference you can hand to your IT manager or your AI vendor when you’re scoping a new deployment.

The Cost of Ignoring Credential Hygiene

Law firms leak between $80,000 and $250,000 per year to inefficiency in intake, document review, and matter admin. AI agents can recover most of that, but only if you trust them with access to your systems. If you can’t trust the access model, you won’t deploy the agent. If you deploy the agent without auditing its credentials, you’re trading efficiency for exposure.

The firms that get this right treat AI credentials the same way they treat human access. They scope permissions, rotate tokens, and audit what each agent can see. They don’t wait for a breach to discover an over-permissioned service account. They don’t assume the agent’s access is safe because it was configured by someone who left six months ago.

The firms that get it wrong either lock down their AI tools so tightly they can’t do useful work, or they grant broad access and hope nothing breaks. Both paths cost money. The first costs opportunity. The second costs trust, and sometimes privilege.

One mid-sized firm spent $40,000 on a document review agent they never deployed because IT couldn’t agree on an access model that satisfied both the AI vendor and the firm’s security policy. The agent sat in a staging environment for nine months. Another firm deployed their intake agent with global CRM access and discovered three months later that the agent had been writing client data to a shared Slack channel visible to two former employees. The cleanup cost more than the agent saved.

You don’t have to choose between efficiency and security. You need to know what your agents can see, scope their access to what they need, and rotate credentials on a schedule that matches your risk tolerance. Most firms can do that in a week once they have the inventory.

See Omni for law firms and we’ll show you exactly where your credential risk sits today.

What Comes After the Audit

The Omni Audit gives you the map. What you do next depends on what we find. For most law firms, the next step is credential remediation. We rotate over-permissioned tokens, scope down service accounts, and disable access for agents that aren’t running. That takes a few hours, not weeks.

Once your credential hygiene is in place, we can talk about which agents make sense for your firm. If you’re losing 30% of after-hours intake because no one answers the phone, the Intake Voice Agent pays for itself in the first month. If your associates are spending six hours a week on first-pass document review, the Document Review Agent frees up billable time you can redeploy to client work. If intake emails sit in your general inbox for two days before someone routes them, the Matter Triage Agent cuts that delay to minutes.

We’ve written more about how law firms are using AI to recover billable hours and reduce intake delays across our insights and guides. You’ll also find case studies and deployment patterns in our learning resources that show what works and what doesn’t.

But the first step is knowing what your AI can see. Most firms don’t. The credential map we build during the audit gives you that visibility, and the remediation plan gives you a path to fix what’s broken.

Book my Omni Audit and we’ll map your AI exposure in 60 minutes. You’ll leave with the credential inventory, the risk score, and the remediation plan. No deck, no follow-up meeting. Just the outputs you need to act.

The new insider has no pulse, but it does have your credentials. Make sure you know what it can see.