Legal AI needs guardrails before it needs features
Tenant-scoped retrieval, citations, usage caps, and prompt-injection boundaries are what make a legal AI assistant safe to put in front of privileged work.
Legal AI should be treated as a controlled workflow, not a magic text box. In a law firm, the same features that make an assistant useful — reading documents, drafting language, answering questions — are the ones that can cause real harm if they cross a client boundary or invent a citation. The order of operations matters: build the guardrails, then the features.
Scope every answer to a single matter
The first rule is isolation. An assistant that can see across clients is a conflict waiting to happen. Retrieval should be scoped to one client’s matter, enforced at the data layer rather than trusted to a prompt. If the model can only ever reach the documents on the matter in front of you, an accidental cross-client leak stops being possible instead of merely unlikely.
Ground answers in the firm’s own documents
A useful legal assistant answers from your files, not from the open internet. Retrieval-augmented generation — pulling the relevant passages from the matter’s documents and asking the model to answer from them — keeps responses tied to what’s actually in the record. Just as important, every answer should carry a citation you can open. If the assistant says the indemnity cap is below your standard floor, you should be able to click through to the clause and confirm it yourself.
Treat document text as untrusted input
Documents in a matter can contain anything, including text that tries to hijack the model (“ignore previous instructions and…”). A production assistant wraps retrieved context so the model treats it as reference material, not as commands. This prompt-injection boundary is invisible when it works and catastrophic when it’s missing.
Put a ceiling on usage
Usage caps aren’t only about cost. They bound the blast radius of a bad prompt, a runaway automation, or a compromised account. Per-firm limits, applied server-side, keep one workspace from affecting another and keep spend predictable.
Keep the attorney in the loop
None of this removes professional responsibility. The safest adoption path makes the assistant excellent at drafting, summarizing, and answering — while the attorney or staff member responsible for the matter always reviews before anything leaves the firm. The assistant does the reading and the first pass; the lawyer does the judgment.
Guardrails first is not the cautious choice. It’s the only version of legal AI that a firm can actually put to work.