Law Firms Need Separate Identities for AI Agents

The security gap is below the model

When a law firm evaluates an AI agent, it’s natural to focus on the model. What can it answer? Does it make mistakes? Can it work with confidential information? Those questions matter, but they don’t cover the basic security issue that appears when an agent connects to a firm’s systems.

The agent needs an identity.

If it uses a lawyer’s login, a shared staff account, or a broad integration credential, the firm may not be able to tell which actions came from the agent and which came from the person. The agent may also inherit access to far more client and matter information than its work requires. A wrong action can be hard to trace, and a compromised credential can expose more than one workflow.

That’s the point behind VentureBeat’s discussion of why the enterprise AI security gap starts below the model. For a law firm, that gap isn’t an abstract IT concern. It can show up when an intake agent reads the wrong matter, a document agent saves a draft in the wrong folder, or an agent sends information using a staff member’s identity.

The practical response is straightforward: give each agent its own identity, narrowly limit what it can access, and keep a record of what it does. Treat the agent like a distinct worker with a defined role, not like a shortcut to a staff member’s account.

Why shared credentials are a problem

A shared credential makes activity harder to explain. Suppose an agent signs into a case management system using a paralegal’s account. It updates a matter status, downloads a file, or creates a contact. The system’s audit trail may record the paralegal as the actor, even though the person didn’t perform the action.

That creates problems for ordinary operations. A partner reviewing a matter’s history can’t easily distinguish agent activity from human work. An administrator investigating a mistake may not know which process acted. If the credential has to be disabled, the firm may also disrupt the employee’s access and other workflows using that same account.

The bigger concern is the scope of access. Staff accounts are usually designed around a person’s job, their matters, and the systems they need to use. An agent’s task is narrower. An intake agent may need to capture a caller’s details, check for conflicts through an approved process, and request a consultation slot. It doesn’t need unrestricted access to all matter files or billing records.

A document review agent may need a specific document set and a place to save its draft memo. It shouldn’t automatically inherit access to the firm’s entire document repository. If one connection gives the agent broad access, a prompt error, mistaken file selection, or security incident can have consequences well beyond the task it was meant to perform.

This is why permissions should be designed around the agent’s job, not copied from a person. Our guide to the new security gap created by agents in law firms goes deeper on how permissions and identity affect day-to-day risk.

Give each agent a job and an identity

Start by listing the agents the firm wants to use and the work each one is allowed to do. Don’t begin with a general account called “AI” that can access every system. Create a separate identity for each agent or distinct workflow, such as intake, matter triage, or document review.

For each identity, write down:

• Which systems it can connect to.
• Which records it can read, create, update, or send.
• Which actions require human approval.
• How its activity is logged and reviewed.
• Who can disable the identity if something goes wrong.

The identity should grant the minimum access needed for the defined task. An intake agent could create an intake record and place a consultation on a calendar, but not open unrelated matter documents. A triage agent might read new submissions and route them to a partner, but not send an engagement letter. A document review agent could access an assigned batch and produce a draft memo, but not file or send it outside the firm.

Use separate access for test and live work where the system supports it. Test the agent with sample or approved data before connecting it to live matters. Decide in advance how the firm will rotate or revoke its credentials. A named owner should be responsible for each agent’s access, even if the vendor handles part of the technical setup.

The controls shouldn’t stop at the login. A firm needs an activity trail that can answer questions like: which agent accessed this file, what did it change, and when? It also needs a way to pause the agent quickly. A narrow identity makes that response more contained. If the intake workflow has a problem, the firm can disable its access without shutting down a document-review process that uses a separate identity.

For more on practical access limits, see how law firms can lock down agent access. The core principle is the same whether an agent runs through an internal integration or a third-party platform. Its identity and permissions should reflect its specific job.

What this looks like in a law firm

Consider a firm that receives calls, website forms, and email inquiries throughout the day. Staff members are balancing client requests with calendar changes, document handling, and matter administration. Intake may sit unanswered during lunch or after hours. New submissions may wait until someone has time to review them.

That delay has a direct commercial cost. After-hours intake can fail to convert, though the rate varies by practice area, call source, and follow-up process. Separately, attorneys may spend time on document review, intake, and matter administration that never makes it onto an invoice. Those hours represent capacity the firm has already paid for but may not recover.

An agent can take on parts of this work, but the workflow still needs boundaries. Here is one way it can run from first contact through handoff.

1. Intake captures the request

An Intake Voice Agent answers a call when staff are unavailable, including after hours, lunch, and weekends. It collects the caller’s contact details and a plain-language description of the matter. It can run the firm’s approved conflict-check process and, when appropriate, book a consultation into the firm’s calendar.

Its identity should be able to create an intake record and schedule the consultation. It shouldn’t have broad access to confidential matter files or permission to make legal judgments about the caller’s situation. The firm sets the questions, escalation rules, and circumstances that require a person to take over. The system should also make clear to the caller what the agent can and cannot do.

2. Triage routes the submission

A Matter Triage Agent reviews new form submissions and emails. It classifies the practice area, scores the inquiry against criteria the firm has defined, and routes it to the right partner with a one-paragraph brief attached.

Its identity should be limited to new submissions and the routing actions it needs. The agent doesn’t need access to every existing client file to summarize a new inquiry. If a submission appears to involve an existing client or a potential conflict, the workflow can flag it for human review rather than acting on an assumption.

3. Document review prepares a draft

A Document Review Agent can handle a first pass on assigned contracts, discovery batches, or matter files. It flags clauses, summarizes positions, and prepares an associate-grade memo for review. This can help reduce the time junior associates spend on repeatable sorting and summarization, particularly when a large batch needs an initial review.

Its identity should only open the assigned documents and save a draft in the right workspace. The agent shouldn’t send that memo to a client, change the official matter record, or file anything externally without human approval. The responsible lawyer remains accountable for checking the output and deciding what goes into the work product.

The workflow becomes safer when each stage has a distinct identity and a clear handoff. The intake agent doesn’t get the document-review agent’s access. The triage agent doesn’t act as a partner. The document agent prepares work for a lawyer rather than presenting its draft as legal advice.

Put a human layer around the controls

Separate identities help answer who or what performed an action. They don’t decide whether that action was appropriate. A firm still needs named owners, review steps, and a way to respond when an agent produces a questionable result.

Set expectations for what gets reviewed before it leaves the firm. For example, a person may need to approve a conflict escalation, a client-facing message, or any document that becomes part of a matter’s official record. Keep the review proportionate to the risk. A draft intake summary may need a different check from a filing or a legal position sent to a client.

Define how staff report problems. If an agent selects the wrong matter, generates an inaccurate summary, or behaves in a way the firm didn’t expect, staff should know where to record the issue and who can pause the workflow. Review agent activity periodically, not just when something goes wrong. Look for unexpected access, repeated failed actions, and tasks outside the agent’s stated role.

This human layer matters because a permission setting can be technically narrow and still be poorly matched to the work. Our article on the human side of agent security in law firms covers the operational responsibilities that sit alongside technical controls.

Connect identity to the money at stake

Missed intake, unbilled administrative time, and work that takes longer than it should can create costs for law firms. That’s not a savings promise or a figure every firm will experience. It’s a way to frame the combined impact of missed intake, unbilled administrative time, and work that takes longer than it should.

A few hours of avoidable work across several people can add up. So can an intake process that leaves promising inquiries waiting for a response. Document review can also become expensive when a first pass consumes days. The point isn’t that an agent eliminates all of this cost. It is that a well-scoped agent can take on defined, repeatable steps while making its activity visible and reviewable.

Security and economics belong in the same conversation. If an agent saves time but uses an employee’s broad credentials, the firm may be taking on a risk it can’t easily inspect or contain. If an agent has a separate identity with limited access, the firm can test the workflow, review its actions, and make a more informed decision about where it belongs.

If you’re considering this for your firm, book a 60-min Omni Audit. In 60 minutes, we’ll map the work, identify the systems and access an agent would need, and define a practical next step. You leave with three outputs: a workflow map, a permissions and risk outline, and a prioritized implementation plan. No deck.

Start with an access map, not a vendor demo

Before connecting an agent to a live system, make a short inventory of the work and permissions involved. Which tasks are candidates for automation? Which records are in scope? What should the agent be able to change? Which actions require approval? Who reviews the activity log, and who can disable access?

That map helps the firm distinguish a useful, contained workflow from a broad integration that happens to work in a demo. It also gives partners, staff, and IT a shared basis for discussing risk. If you’re comparing how the pieces fit together, see Omni for law firms.

For a practical worksheet, download the AI Client Intake Checklist for Law Firms. It helps your team think through the intake steps, information to collect, and follow-up process before automating the first contact. You can also get the checklist directly.

The useful question isn’t just whether an agent can do the work. It’s whether the firm can tell what it did, limit what it can reach, and stop it without affecting unrelated work. Start with one defined workflow, give it a separate identity, and check the permissions before it touches client or matter systems.

See the AI audit for law firms to discuss where that first workflow makes sense. Or book a 60-min Omni Audit to leave with a practical map of the work, access boundaries, and next steps.