Governance for Claude in Legal: Guardrails Before Scale

There is a moment in every legal AI program where a managing partner asks the only question that really matters: "If this tool makes a mistake on a client matter, who is responsible, and how would we even know?" If you cannot answer that crisply, you are not ready to scale Claude across the practice, no matter how good the productivity numbers look in the pilot. Governance is not the brake on a legal AI deployment; it is the thing that lets you take your foot off the brake.

This post lays out the guardrails legal leadership should have in place before Claude moves from a few careful users to firm-wide infrastructure — covering confidentiality, privilege, model access, audit, and the human checkpoints that keep the firm's professional obligations intact.

Confidentiality and privilege are the first gate

A law firm's core asset is client confidence, and its most dangerous failure mode is breaching it. Before any matter data touches Claude, leadership needs a clear, written map of what may be sent where. That map should distinguish between Claude offerings with different data handling — enterprise deployments with zero-retention and no-training guarantees versus consumer tiers — and tie each client matter to an approved configuration based on its confidentiality requirements and any client-specific outside-counsel guidelines.

Privilege deserves its own analysis. The prevailing view is that using a confidential AI tool under appropriate terms does not waive attorney-client privilege, much as using an outside e-discovery vendor does not, but this is a question your firm's own risk committee must reason through and document rather than assume. The governance artifact here is a privilege-and-confidentiality policy that names the approved Claude configuration, the matters excluded entirely, and the basis for the firm's position. Write it down before you scale, because reconstructing it after an incident is far worse.

The control architecture leadership should require

Governance becomes real when it is enforced by architecture, not just policy memos. The pattern that works wraps every Claude interaction in a few non-optional layers: identity and matter-tagging at the entry point, a routing layer that maps the matter to an approved model and data-handling tier, content filtering for anything that must never leave the firm, and an immutable log of every request and response.

flowchart TD
  A["Lawyer request + matter ID"] --> B{"Matter approved for AI?"}
  B -->|No| C["Block & log"]
  B -->|Yes| D["Route to approved Claude tier"]
  D --> E["Claude responds"]
  E --> F{"Filing or client-facing?"}
  F -->|Yes| G["Mandatory human review gate"]
  F -->|No| H["Internal use"]
  G --> I["Immutable audit log"]
  H --> I

The audit log is the answer to the managing partner's question. When every interaction — who, which matter, which model, what prompt, what output, who reviewed it — is captured immutably, the firm can reconstruct exactly what happened on any matter. That record is what lets you scale with confidence: not the belief that mistakes will never happen, but the certainty that you will catch and explain them.

Human-in-the-loop is a governance control, not a courtesy

For legal work, the human review checkpoint is a hard requirement on anything that leaves the firm or enters a court. This is not bureaucratic caution; it is the professional-responsibility floor. A lawyer remains responsible for the work product regardless of how the first draft was produced, and the sanctions imposed on lawyers who filed AI-hallucinated citations make this concrete and public. Governance should specify exactly which outputs require a named human reviewer before release, and the audit log should record that the review occurred.

The nuance worth getting right is calibrating the gate to risk. A summary used internally to orient a partner needs lighter review than a brief filed with a court. Over-gating everything trains people to rubber-stamp, which is worse than a targeted gate they take seriously. Map your review intensity to the consequence of an error, and be explicit about it.

Tool access and agent permissions

As deployments grow into agentic workflows — Claude using Model Context Protocol connectors to reach the document-management system, billing, or court dockets — governance has to cover what the agent is allowed to do, not just what it is allowed to read. Model Context Protocol is an open standard that lets Claude connect to external tools and data through MCP servers, and each connection is a permission you are granting. Read access to a precedent bank is low-risk; write access to a billing system or the ability to send email on a lawyer's behalf is a different category entirely and should require explicit, scoped approval and logging.

The principle is least privilege, applied to agents. Give each agentic workflow exactly the tools its task requires and nothing more, scope credentials to the matter where possible, and log every tool invocation. An agent that can read the docket to build a deadline calendar is useful and safe; the same agent with unscoped write access to your filing system is a liability waiting to happen.

Bias, accuracy, and the duty of competence

Leadership also owns the harder, fuzzier risks. Claude is strong but not infallible, and legal outputs can carry subtle errors — a misread holding, an outdated statute, a plausible-but-wrong characterization of a clause. The governance response is twofold: maintain a verification culture (covered by the human-review gates) and run periodic evals on the task types you rely on most, sampling real outputs and grading them against expert review. The duty of competence increasingly includes understanding the tools you use, so the firm should be able to show it actively monitors quality rather than assuming it.

Frequently asked questions

Does using Claude waive attorney-client privilege?

The prevailing view is that using a confidential AI tool under appropriate enterprise terms — zero-retention, no-training — does not waive privilege, analogous to using an outside e-discovery vendor. But your firm's risk committee should reason through and document its own position rather than assume it, and exclude especially sensitive matters until that analysis is settled.

What governance controls are non-negotiable before scaling?

Matter-level access mapping to approved model tiers, content filtering for data that must never leave the firm, a mandatory human-review gate on anything filed or client-facing, and an immutable audit log of every interaction. Together these let you reconstruct and explain any incident, which is what makes scaling safe.

How should we govern agents that use tools via MCP?

Apply least privilege to agents. Grant each workflow only the MCP connectors its task needs, distinguish sharply between read and write access, scope credentials to the matter where possible, and log every tool invocation. Read access to precedents is low-risk; write access to billing or email is a separate, explicitly-approved category.

How do we satisfy the duty of competence with AI?

Show active oversight, not assumption. Maintain human-review gates calibrated to risk, run periodic evals on your highest-volume task types graded against expert review, and keep the audit trail that demonstrates the firm monitors quality. Competence now includes understanding and supervising the tools you deploy.

Bringing agentic AI to your phone lines

CallSphere brings the same governed, human-supervised agentic patterns to voice and chat — assistants that answer every call and message, act through approved tools mid-conversation, and log every interaction for review. See the controls in action at callsphere.ai.

---

Source & attribution: This is an independent, original explainer inspired by Anthropic's coverage on the Claude blog. Claude, Claude Code, Claude Cowork, Claude Opus, and the Model Context Protocol are products and trademarks of Anthropic. CallSphere is not affiliated with or endorsed by Anthropic.