Enterprise
Governance and access
Set practical review, permission, matter-access, and accountability standards for legal work
Good governance makes safe behaviour the ordinary path through the product. Decide who can act, what requires review, how sensitive matters are isolated, and which evidence must remain available later.
Access building blocks#
Roles and permissions
Built-in templates establish common responsibilities. Custom roles and delegated administration narrow authority to durable organisation needs.
Groups
Departments, offices, practice groups, and operational teams make repeatable access and assignment easier to maintain.
Matter grants
Restricted matters and ethical walls use explicit grants rather than assuming that workspace membership is enough.
Guests and service accounts
External people and automation identities receive explicit scope instead of general employee workspace access.
Decisions to make before broad rollout#
- Who can create matters, invite people, manage access, configure workflows, and export data.
- Which work requires restricted matter access or an ethical wall.
- Which document types may be uploaded and which classifications require extra controls.
- Which AI sources and models may be used for each category of work.
- Which outputs can be shared internally and which require independent approval.
- How temporary support access is requested, approved, limited, and reviewed.
Minimum review standards#
| Output | Suggested minimum review |
|---|---|
| Internal research note | Qualified legal reviewer checks reasoning and authorities |
| Client-facing advice | Responsible lawyer reviews and signs off |
| Contract draft for negotiation | Lawyer review under the matter's approval policy |
| Filing or court submission | Supervising lawyer and required independent review |
| AI-extracted deadline | Lawyer confirms the trigger, rule, assumptions, and resulting date |
| Playbook findings | Legal owner reviews before external use |
Governance evidence#
Use audit search, access reviews, security events, workflow history, approvals, retention jobs, exports, and support-access records to show what happened. Avoid creating a policy that depends on reconstructing decisions from private messages.
Keep the operating rules short enough to use under time pressure. Link each rule to a product control, an accountable owner, and an evidence source.
On this page