Lawve Agentic Delegation Audit Ignacio Adrian Lerer

Lawve Agentic Delegation Audit

Use this skill to help lawyers evaluate whether an AI agent workflow is safe enough to use in legal or business operations.

Core idea:

textCopy code
When AI only answers, the user evaluates an output.
When AI acts, the user delegates authority.
Delegated authority needs controls, logs, revocation, and accountability.

Use When

• A client wants to use an AI agent for legal, compliance, business, or administrative work.
• A product, law firm, or legal ops team is connecting an agent to email, files, CRM, court portals, payments, messaging, calendars, databases, browser tools, or code execution.
• A lawyer needs to explain the risks of agentic AI in practical governance terms.
• A workflow may send, file, delete, approve, purchase, publish, sign, deploy, or change access.
• A system claims to be "autonomous", "agentic", "assistant with tools", "AI employee", "legal copilot", or "workflow agent".

Do Not Use For

• Pure doctrinal legal research with no agentic action.
• Final legal opinions without jurisdiction-specific legal review.
• Technical implementation of an agent runtime.
• Approving production use of an agent without evidence, logs, and controls.

Intake

Collect only what is necessary:

• What task does the agent perform?
• Who is the human principal?
• Who deploys or operates the agent?
• What systems, accounts, files, channels, or tools can it access?
• What actions can it take without step-by-step approval?
• Which actions are irreversible, external, financial, legal, confidential, or reputation-sensitive?
• What logs exist and who can read them?
• How can the user pause, revoke, appeal, or correct the agent?
• What data can influence the agent, including emails, webpages, chats, files, tickets, and prompts?

Audit Steps

1. Classify the autonomy level

   • answer_only: produces information only.
   • draft_only: drafts but does not send or change records.
   • approval_gated_actor: acts only after explicit approval.
   • policy_bounded_actor: acts within predefined limits.
   • long_running_actor: continues across time, sessions, or triggers.

2. Map delegated authority

   • Name the principal.
   • Name the deployer/operator.
   • List what authority the agent has.
   • Separate read, draft, internal write, external write, financial, legal-sensitive, and privileged actions.

3. Check observability

   • Can the user see what the agent did?
   • Are tool calls and external actions logged?
   • Are logs understandable by a non-developer?
   • Are source data and model inference separated?

4. Check control and revocation

   • Can the user pause the agent?
   • Can permissions be narrowed?
   • Can access be revoked quickly?
   • Are irreversible actions previewed before execution?

5. Check accountability

   • Who is responsible if harm occurs?
   • Is responsibility split across vendor, deployer, user, professional, and client?
   • Is there a human review point before legal reliance or external action?

6. Check attack surface

   • Can untrusted content influence the agent?
   • Does the agent process emails, webpages, chats, documents, tickets, or social posts as instructions?
   • Are external content and system instructions separated?
   • Are prompt injection, data exfiltration, and tool misuse considered?

7. Apply legal uncertainty gate

   • Use PASS, ESCALATE, or BLOCK for downstream legal/business reliance.
   • Do not hide material uncertainty in disclaimer text.

Output

Use this compact format:

markdownCopy code
## Agentic Delegation Audit

### Verdict
PASS | NEEDS CONTROLS | BLOCK

### Why
[2-5 sentences]

### Delegated Authority
- Principal:
- Deployer/operator:
- Autonomy level:
- Systems/tools:
- Highest-risk action:

### Control Checklist
- Permission scope: adequate | weak | missing
- Human approval before external/legal/financial action: yes | partial | no
- User-readable logs: yes | partial | no
- Revocation/pause: yes | partial | no
- Prompt-injection/data-boundary controls: yes | partial | no
- Accountability owner: clear | partial | unclear

### Required Controls
- [control 1]
- [control 2]
- [control 3]

### Legal Reliance Gate
PASS | ESCALATE | BLOCK

### Next Step
[smallest practical next step]

Decision Rules

• PASS: agent is draft-only or tightly approval-gated, logs are clear, permissions are scoped, and no material legal/client risk remains unmanaged.
• NEEDS CONTROLS: agent may be useful, but missing controls prevent safe operational reliance.
• BLOCK: agent can perform external, legal, financial, confidential, destructive, or privileged actions without adequate approval, logging, revocation, or accountability.