Superintelligent Agents for Law Firms: Matters, Research, Review

Superintelligent agents for law firms are, for now, a direction rather than a product: agents far more capable than today's at holding a whole matter in mind, researching across sources and reviewing documents in depth. A firm cannot buy that capability off the shelf, but it can build the parts that decide whether such an agent will be safe and useful: organized matter memory, permissioned access, privilege-aware boundaries and a habit of evaluation. Those same parts make today's agents more reliable.

Key takeaways

• A more capable agent raises the value of well-kept matter files and raises the cost of loose access rules, so the foundation matters more than the model.
• Matter memory should be scoped per matter, with ethical walls enforced by permissions, not by instructions written in a prompt.
• Research and review gain the most when every claim is tied to a source a lawyer can open and check.
• Privilege is an architecture question: where data flows, who can read it, what is logged and which vendors touch it.
• Start with one matter type, one role, a human approval step and a measurable check, then widen only after the results hold.

What would a far more capable agent actually be?

Today's agents can draft, summarize and search, but they lose the thread on long matters, need close supervision and sometimes state things with more confidence than the record supports. A far more capable agent would hold more context at once, plan multi-step work with fewer errors, notice when two documents contradict each other and ask better questions before acting.

That is a reasonable expectation, not a promise with a date. The useful posture for a firm is to design for a stronger agent without depending on one. If the structure around the agent is sound, a better model improves the work. If the structure is weak, a better model simply makes the weakness faster.

Three things change in the way a firm operates, and they map to the three areas in the title: how the firm remembers a matter, how it researches, and how it reviews. Each depends on boundaries that a lawyer, not the software, must own.

How would matter memory change?

Most firms already hold matter memory, but it is scattered: the document system, email threads, billing notes, a partner's recollection, a paralegal's private spreadsheet. A capable agent could assemble these into a living working file: parties, key dates, positions taken, open questions, who promised what to whom, and which documents support each point.

The value is continuity. When an associate leaves a matter or a new lawyer joins, the agent can brief them from the record, with each statement linked to its source. When opposing counsel changes position, the agent can show where the firm said something different earlier.

The risk is equal and opposite. Memory that crosses matters is a conflict and confidentiality problem. A few design rules follow:

• Memory belongs to one matter. Nothing learned in one matter is retrievable in another unless a lawyer explicitly moves it.
• Ethical walls are enforced in the access layer. If a lawyer cannot open a folder, the agent acting for that lawyer cannot retrieve from it either.
• Every remembered fact carries a source and a date, so stale or disputed items can be flagged.
• Deletion and retention follow the firm's policy and client instructions, including when a matter closes.

The access principle is standard security practice. The [OWASP authorization guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) describes least privilege and server-side checks, and both apply directly: the agent should inherit the permissions of the person it serves, never more.

For a practical first look at intake and deadline work, which is where matter memory usually starts, see the setup guide for law firm agents.

How would legal research change?

Legal research with a stronger agent moves from finding documents to assembling an argument map. The agent could read a body of authority, separate binding from persuasive sources, note where courts diverge, and list the facts of your matter that would change the analysis. It could also keep a running record of what was searched, so the lawyer sees what was covered and what was not.

The discipline that keeps this safe is simple: the agent proposes, the lawyer verifies. A fluent summary is not a citation. Every authority the agent names must link to the actual text in a source the firm trusts, and the lawyer reads the passage before relying on it. Retrieval grounded in real documents helps here, because the answer is built from retrieved text rather than from the model's memory. The [AWS overview of retrieval-augmented generation](https://aws.amazon.com/what-is/retrieval-augmented-generation/) explains the pattern in plain terms.

A useful research output has a fixed shape:

• The question as the agent understood it, so misreadings surface early.
• The sources searched and the ones that were unavailable.
• Each proposed authority with a link, the relevant passage and the reason it matters.
• Points of uncertainty and anything that conflicts.
• A clear marker that no part of it has been verified by a lawyer yet.

That last line is not decoration. It keeps the status of the work honest as it moves between people.

How would document review change?

Review is where capability and risk meet most directly. A stronger agent could read a production set, group documents by issue, flag likely privileged items, draft a privilege log entry for each and explain its reasoning. It could notice that a document marked routine mentions a topic central to the dispute.

The agent should not make the final privilege call. It should sort, explain and queue. A lawyer decides, and the decision becomes part of the record that teaches the next round.

Illustrative scenario: a small litigation team receives a large set of documents from a client. The agent sorts them into three queues: likely privileged, likely responsive and not privileged, needs a closer look. For each item in the first queue it quotes the lines that suggest legal advice and names the lawyer involved. A senior associate samples each queue, corrects the agent where it is wrong, and those corrections are saved as examples for the next batch. The team notes how often reviewers overturn the agent and tightens the rules for the categories where it errs.

The sampling step is what makes this trustworthy. Without a repeatable check, you only have an impression that the agent is good. The Anthropic piece on [evaluating AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) is a helpful reference for turning that check into a routine test set rather than a one-time impression.

What do privilege rules require of the design?

Privilege and confidentiality duties vary by jurisdiction, by client agreement and by court. Your professional responsibility counsel or general counsel should set the rules. What a builder can do is make those rules enforceable. Questions to settle before any client data reaches an agent:

• Where does client data go when the agent processes it, and which vendors or model providers can see it?
• Do contracts with those providers restrict retention and use of the data, in line with what your clients have agreed to?
• Can the agent reach only the matters its user is permitted to see?
• Is every retrieval and every action logged in a way the firm can review?
• Does the client's engagement letter or outside counsel guideline say anything about automated tools?

There is also an attack surface that law firms often overlook. Documents from the other side, emails and web pages are untrusted text, and a hostile one can contain instructions aimed at the agent, such as telling it to forward files or ignore its rules. The [OWASP prompt injection prevention guide](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) covers the defensive habits: treat retrieved content as data, limit what tools the agent can call, and require human approval for any action that sends information outside the firm.

Finally, keep the agent's powers narrow. An agent that can read and draft is far easier to govern than one that can also send, file or delete. Grant each power separately, with an approval step.

What should a firm build now?

You do not need to wait for a stronger model to prepare. The following plan works with today's agents and carries forward.

• Choose one matter type and one role, such as a research assistant for a single practice group or a chronology builder for litigation.
• Write down what the role may read, what it may draft and what it may never do, including contact with clients or outside parties.
• Clean the sources: consistent matter numbers, folder structure, document naming and a clear owner for each matter file.
• Set permissions through the firm's existing identity system so the agent inherits the user's access and the walls hold.
• Require source links on every statement and a named lawyer who approves anything that leaves the firm.
• Build a small test set from past work, with known answers, and run it before every change to the agent.
• Log retrievals, drafts and approvals, and review the log on a schedule with someone who has authority to pause the agent.
• Widen scope only after the checks hold for a sustained period, and document each expansion.

The [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) offers a neutral vocabulary for this kind of governance: mapping risks, measuring them, managing them and assigning accountability. Firms with an existing risk committee can use it to structure the conversation.

Other professional-services firms face a similar problem of keeping records separate by client. The way engineering firms handle project memory and client walls is a close parallel and worth reading for the design patterns.

How does a managed approach handle this?

Be Human designs, implements and operates personalized AI infrastructure in which agents keep their identity, memory, channels, tools and permissions under human control. A first engagement defines one useful role, the memory and tools it needs, the approval boundaries and a success criterion that can be observed. For a law firm, that typically means a narrowly scoped role, matter-level memory, access that mirrors existing permissions and a lawyer approving anything consequential. Managed operations can then cover monitoring, recurring evaluations, integration maintenance, permission review and incident response, so changes to the agent are controlled rather than ad hoc. The service is remote and available in English and Portuguese.

If you want help finding the first task worth handing to an agent in your firm, take the free Be Human AI diagnostic.

Frequently asked questions

Are superintelligent agents for law firms available today? No, not in the sense of agents far beyond current capability. Firms can use capable agents now for bounded work such as research drafts, chronologies and first-pass review, while building the memory, permissions and evaluation that a stronger agent would need.

Will an agent put attorney-client privilege at risk? It can if data flows are not controlled, which is why the design matters more than the tool. Know which providers see client data, restrict retention by contract, enforce access by matter and keep a lawyer in the approval path. Your counsel should confirm the rules that apply in your jurisdiction.

Can an agent make the final call on privilege or on a legal authority? It should not. The agent can sort, explain and cite, but a lawyer decides and signs off. Treat the agent's output as a draft with sources, and sample its work against known answers to see where it needs tighter limits.

Where should a small firm start? Pick one repeatable task in one practice area, such as intake summaries, deadline tracking or research memos with linked sources. Define what the agent may touch, keep a lawyer approving the result and measure it against past work before extending it to anything else.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.