LEGAL-RAG-011 / LEGAL
Private retrieval preserved the matter boundary
An international law partnership building an in-environment research and matter-support system over privileged client files.
Context
Lawyers needed faster access to prior analysis and matter documents across multiple jurisdictions, while ethical walls, residency, privilege, and source traceability remained non-negotiable.
The problem beneath the brief
The first architecture optimized answer quality before defining who could retrieve which material, how every statement returned to source, and when the system had to abstain.
- 24
- ethical-wall scenariospermission test pack
- 100%
- substantive answers source-linkedacceptance evaluation
- 0
- cross-matter results in gate setrelease evidence
Risk constraints
What could not be traded away.
- privilege
- ethical walls
- data residency
- source attribution
- attorney judgment
Findings
What inspection changed.
- document permissions were less granular than matter policy
- cross-language retrieval could surface a semantically related but unauthorized matter
- users interpreted fluent synthesis as legal conclusion
Architecture
The operating system we installed.
- 01in-environment indexingaccess inheritance
- 02matter-scoped retrievalethical-wall tests
- 03permission-aware chunkingcitation completeness
- 04source-grounded responseprompt and result audit
- 05abstention and review workflowattorney review
Delivery sequence
Four gates. No ceremonial phase changes.
- 01
Frame
Define the decision, outcome, work products, authority, dependencies, exclusions, and acceptance evidence.
A named sponsor and principal approve the bounded charter. - 02
Inspect
Observe the operating reality, trace systems and records, test assumptions, and rank failure modes.
Critical unknowns have owners, evidence plans, and stop conditions. - 03
Build
Implement the smallest coherent change with versioned decisions, controls, and verification attached.
The integrated state meets the agreed evidence threshold. - 04
Transfer
Rehearse recovery, resolve exceptions, accept the work, remove temporary access, and transfer operating ownership.
The receiving owner signs the handoff with open limits visible.
Complications
Where the plan had to become more honest.
- A highly relevant precedent was correctly withheld because the requesting matter lacked access.
- A bilingual query exposed taxonomy inconsistency rather than a model defect.
Outcomes
What changed—and what the record proves.
- Retrieval inherited matter access and denied cross-wall results before generation.
- Every substantive response linked to approved source passages.
- The system abstained on unsupported conclusions and routed the question to an attorney.
Lessons
What we would carry into the next system.
- Permission-aware retrieval starts before vector search.
- Fluency must never obscure source and authority.
- A denied relevant result can be evidence that the system works.
Handoff
The engagement ended with an operating owner.
- 01matter-policy owner
- 02evaluation-corpus versioning
- 03access and incident review
- 04attorney feedback route
- 05model and index change control
Start with the decision
Bring the priority. We will help bound the work.
If the decisions or constraints look familiar, start with the operating reality—not a preselected solution.
Start a conversation.